Link [ pkgsrc | NetBSD | pkgsrc git mirror | PR fulltext-search | netbsd commit viewer ]


   
        usage: [branch:branch] [user:user] [path[@revision]] keyword [... [-excludekeyword [...]]] (e.g. branch:MAIN pkgtools/pkg)




switch to index mode

recent branches: MAIN (3m)  pkgsrc-2024Q1 (3d)  pkgsrc-2023Q4 (77d)  pkgsrc-2023Q2 (110d) 

2024-06-17 12:02:11 UTC Now

2011-11-28 19:33:13 UTC MAIN commitmail json YAML

security/kth-krb4: Add DragonFly and FreeBSD support

The majority of these patches were inspired from FreeBSD's ports.  FreeBSD,
along with at least Debian, have removed Kerberos4 due to secuity concerns.
From: http://web.mit.edu/kerberos/krb4-end-of-life.html :

"Serious protocol flaws[2] have been found in Kerberos 4. These flaws permit
attacks which require far less effort than an exhaustive search of the DES
key space. These flaws make Kerberos 4 cross-realm authentication an
unacceptable security risk and raise serious questions about the security of
the entire Kerberos 4 protocol.

The known insecurity of DES, combined with the recently discovered protocol
flaws, make it extremely inadvisable to rely on the security of version 4 of
the Kerberos protocol. These factors motivate the MIT Kerberos Team to remove
support for Kerberos version 4 from the MIT implementation of Kerberos."

This end-of-life announcement is dated 19 October 2006.  I think it's a
good question to ask why this package and the packages that depend on it
are still in pkgsrc.

(marino)