From nobody Mon Jun 16 04:28:49 2025 X-Original-To: freebsd-current@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bLH7v2XBTz5yT9B for ; Mon, 16 Jun 2025 04:28:59 +0000 (UTC) (envelope-from minsoochoo0122@proton.me) Received: from mail-4319.protonmail.ch (mail-4319.protonmail.ch [185.70.43.19]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "protonmail.com", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bLH7v09Nfz3dcK; Mon, 16 Jun 2025 04:28:58 +0000 (UTC) (envelope-from minsoochoo0122@proton.me) Authentication-Results: mx1.freebsd.org; none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=proton.me; s=protonmail; t=1750048136; x=1750307336; bh=LE9Zlr4vtiKezcBFdvJFqGHGXgFhloOYGTaBBQWik2Y=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector:List-Unsubscribe:List-Unsubscribe-Post; b=kacyCYkULTDOA9udBUAXQYsMeD+jKrLvu/aY7vF8yD1b9SEuaOt74sTaRs45ywhGs dJkEfz4Yple006Q7cGsR6NhgyXMgQW+jE+6XE8PyS/qDECqqMVDVSYI3KSshUW+Aqp 0GYE6Vo3FYrQeRf3TPz1+YnvYzLJxZkj/dmEbmxsy4/c/Rk3UTmd9oePsqh6jrf2zg VApw82Os0gnKHo3d8TU9+k+gpm1t+itkkUf6yPub/AsPtKEb1eAMvwYB2kqYIEoANP YrnvjyW9qju9HtmgPNZFdmhDOI9er2rE2Ve7m+v6Ydn68AYqDU8+yF9haFGnhI3m2q VQR5HrbFYDUgg== Date: Mon, 16 Jun 2025 04:28:49 +0000 To: Cy Schubert From: Minsoo Choo Cc: freebsd-current@freebsd.org, emaste@freebsd.org, jrm@freebsd.org Subject: Re: MIT KRB5 in 15-CURRENT Message-ID: In-Reply-To: <20250616034233.ED587134@slippy.cwsent.com> References: <20250616034233.ED587134@slippy.cwsent.com> Feedback-ID: 45891198:user:proton X-Pm-Message-ID: 772d4311fbeb368c435db1b8ae24713d8e69aaea List-Id: Discussions about the use of FreeBSD-current List-Archive: https://lists.freebsd.org/archives/freebsd-current List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-current@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 4bLH7v09Nfz3dcK X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:62371, ipnet:185.70.43.0/24, country:CH] On Sunday, June 15th, 2025 at 11:43 PM, Cy Schubert wrote: > Hi freebsd-current@, >=20 > MIT KRB5 has been imported. It is disabled by default. To build and insta= ll > MIT KRB5 in 15-CURRENT, >=20 > 1. Add WITH_MITKRB5=3Dyes in src.conf. >=20 > 2. Do a buildworld and buildkernel. >=20 > 3. Then installworld, run etcupdate to update files in /etc. >=20 > 4. make delete-old and delete-old-libs. This is important. Skip this step > and your > resulting install will contain both MIT and Heimdal Kerberos. This will > not work. >=20 > Avoid using MIT KRB5 (for now) if you are running a Heimdal 1.5.2 KDC on > FreeBSD. There is a > procedure to convert the Heimdal HDB to an MIT KRB5 KDB. I am still worki= ng > on documenting the procedure. The process is not straightforward as our > Heimdal 1.5.2 is very old and does not support the feature found later > versions of Heimdal needed to migrate the HDB to KDB. In a nutshell: one > must export the HDB, import it into the latest version of Heimdal (using > ports/security/heimdal), then export an MIT KRB5 export, and finally impo= rt > it into a new MIT KRB5 KDB. >=20 > If you use FreeBSD as part of an Active Directory domain, MIT KRB5 will > simplify integration into a Microsoft network. You will still need to use > winbind from samba or sssd, as Active Directory uses MIT KRB5 and LDAP fo= r > authentication. >=20 > A ports exp-run will be needed to list any ports that may fail to build > with MIT KRB5 in base. If any are found they will be fixed before we swit= ch > the default from Heimdal 1.5.2 to MIT KRB5 1.21.3. >=20 > A decision to remove Heimdal from the source tree will come sometime afte= r > the default has been switched from Heimdal to MIT KRB5. >=20 > I also expect some ports plumbing changes, especially in Mk/Uses/gssapi.m= k > in order to support MIT KRB5 in base. Any required changes should be > identified with an exp-run. >=20 >=20 > -- > Cheers, > Cy Schubert Cy.Schubert@cschubert.com >=20 > FreeBSD UNIX: cy@FreeBSD.org Web: https://FreeBSD.org >=20 > NTP: cy@nwtime.org Web: https://nwtime.org >=20 >=20 > e**(i*pi)+1=3D0 >=20 >=20 Thank you for your great work. I will close D43625 and D43624 as the adopti= on of MIT krb5 makes them obsolete. I have a few questions regarding to MIT krb5 replacing heimdal: 1. In which FreeBSD version will MIT krb5 be default? 2. In which FreeBSD version will heimdal be removed? Regards, Minsoo