Full_Name: Calvin Winkowski
Submission from: (NULL) (2001:468:c80:a202:3b1d:f567:f43c:7b3a)
When using ldapsearch GSSAPI mechanism with a server whose reverse DNS name
doesn't match its DNS name, ldapsearch will do the DNS lookups and hand the
reverse DNS entry to GSSAPI. If the reverse DNS entry is not what is used by
kerberos then kerberos will fail. There are settings in /etc/krb5.conf to
disable canonicalizing the hostname provided.
I have a server with a record example.ad.example.com
whose PTR record is
, but the realm is ad.example.com
and it's entry in the
kerberos database is example.ad.example.com
, not example.example.com
If I execute the command ``ldapsearch -b "" -s base -Y GSSAPI -D "dn"
ldap://example.ad.example.com'' GSSAPI will submit a ticket request for
instead and result in a failure. All other services I've
tested with this setup (disabling reverse dns in kerberos) do not give the PTR
record, but the user provided hostname. These include mbsync, msmtp, and another
ldap utility. I believe that the correct behaviour should be to provide the
hostname provided to the utility to GSSAPI. I can provide packet captures
illustrating the incorrect lookup if needed.