severity 482679 normal tags 482679 moreinfo thanks Bastian Blank <[EMAIL PROTECTED]> writes:
> Package: krb5-admin-server > Version: 1.6.dfsg.3-2 > Severity: important > There is no documentation about the firewall changes necessary for the > kpasswd service. This is problematic because the naiv variant[1] does > not work. kadmin uses a different source port for the communication back > to the client. Could you provide more information about where you're seeing this problem? Stanford University is using, in production, the following firewall rules: KDC: -A INPUT -p udp -m udp --dport 464 -j ACCEPT Client: -A INPUT -p udp -m udp --sport 464 -m state --state ESTABLISHED -j ACCEPT and it works for us, so you're running into something that I've not seen. Maybe the problem is specific to a multihomed KDC? That would make logical sense to me, and if so I can certainly document that. (Fixing it might be another matter, although there are some patches filed upstream for that.) -- Russ Allbery ([EMAIL PROTECTED]) <http://www.eyrie.org/~eagle/> -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
