From a159ad30489acb7aeb35d95de805f81c64d07966 Mon Sep 17 00:00:00 2001 From: Neil Conway Date: Mon, 27 Jun 2005 02:04:26 +0000 Subject: Remove support for Kerberos V4. It seems no one is using this, it has some security issues, and upstream has declared it "dead". Patch from Magnus Hagander, minor editorialization from Neil Conway. --- doc/src/sgml/client-auth.sgml | 26 ++++--------------- doc/src/sgml/installation.sgml | 6 ++--- doc/src/sgml/libpq.sgml | 6 ++--- doc/src/sgml/protocol.sgml | 59 +----------------------------------------- 4 files changed, 11 insertions(+), 86 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index 83611d25ffb..d2585e3a94f 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -1,5 +1,5 @@ @@ -326,17 +326,6 @@ hostnossl database user - - krb4 - - - Use Kerberos V4 to authenticate the user. This is only - available for TCP/IP connections. See for details. - - - - krb5 @@ -623,11 +612,8 @@ local db1,db2,@demodbs all md5 - While PostgreSQL supports both Kerberos 4 and - Kerberos 5, only Kerberos 5 is recommended. Kerberos 4 is - considered insecure and no longer recommended for general - use. Only one version of Kerberos can be supported in any one - build, and support must be enabled at build time. See + PostgreSQL supports Kerberos version 5, and it has + to be enabled at build time. See for more information. @@ -669,11 +655,9 @@ local db1,db2,@demodbs all md5 account. (See also .) The location of the key file is specified by the configuration - parameter. The default - is /etc/srvtab if you are using Kerberos 4 and + parameter. The default is /usr/local/pgsql/etc/krb5.keytab (or whichever - directory was specified as sysconfdir at build time) - with Kerberos 5. + directory was specified as sysconfdir at build time). diff --git a/doc/src/sgml/installation.sgml b/doc/src/sgml/installation.sgml index 547dd6436de..2f240a917b9 100644 --- a/doc/src/sgml/installation.sgml +++ b/doc/src/sgml/installation.sgml @@ -1,4 +1,4 @@ - + <![%standalone-include[<productname>PostgreSQL</>]]> @@ -787,12 +787,10 @@ su - postgres </varlistentry> <varlistentry> - <term><option>--with-krb4</option></term> <term><option>--with-krb5</option></term> <listitem> <para> - Build with support for Kerberos authentication. You can use - either Kerberos version 4 or 5, but not both. On many + Build with support for Kerberos 5 authentication. On many systems, the Kerberos system is not installed in a location that is searched by default (e.g., <filename>/usr/include</>, <filename>/usr/lib</>), so you must use the options diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index a5bde7fc76e..74219f368b6 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -1,5 +1,5 @@ <!-- -$PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.187 2005/06/26 19:16:04 tgl Exp $ +$PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.188 2005/06/27 02:04:24 neilc Exp $ --> <chapter id="libpq"> @@ -283,7 +283,7 @@ PGconn *PQconnectdb(const char *conninfo); <term><literal>krbsrvname</literal></term> <listitem> <para> - Kerberos service name to use when authenticating with Kerberos 4 or 5. + Kerberos service name to use when authenticating with Kerberos 5. This must match the service name specified in the server configuration for Kerberos authentication to succeed. (See also <xref linkend="kerberos-auth">.) @@ -3813,7 +3813,7 @@ setting, and is only available if <primary><envar>PGKRBSRVNAME</envar></primary> </indexterm> <envar>PGKRBSRVNAME</envar> sets the Kerberos service name to use when -authenticating with Kerberos 4 or 5. +authenticating with Kerberos 5. </para> </listitem> <listitem> diff --git a/doc/src/sgml/protocol.sgml b/doc/src/sgml/protocol.sgml index 7ebcfc63a34..9663c7c08c6 100644 --- a/doc/src/sgml/protocol.sgml +++ b/doc/src/sgml/protocol.sgml @@ -1,4 +1,4 @@ -<!-- $PostgreSQL: pgsql/doc/src/sgml/protocol.sgml,v 1.60 2005/06/26 19:16:04 tgl Exp $ --> +<!-- $PostgreSQL: pgsql/doc/src/sgml/protocol.sgml,v 1.61 2005/06/27 02:04:24 neilc Exp $ --> <chapter id="protocol"> <title>Frontend/Backend Protocol @@ -264,19 +264,6 @@ - - AuthenticationKerberosV4 - - - The frontend must now take part in a Kerberos V4 - authentication dialog (not described here, part of the - Kerberos specification) with the server. If this is - successful, the server responds with an AuthenticationOk, - otherwise it responds with an ErrorResponse. - - - - AuthenticationKerberosV5 @@ -1411,50 +1398,6 @@ AuthenticationOk (B) - - -AuthenticationKerberosV4 (B) - - - - - - - - Byte1('R') - - - - Identifies the message as an authentication request. - - - - - - Int32(8) - - - - Length of message contents in bytes, including self. - - - - - - Int32(1) - - - - Specifies that Kerberos V4 authentication is required. - - - - - - - - - AuthenticationKerberosV5 (B) -- cgit v1.2.3