IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Prefer TCP connections to UDP in krb5 clients

Browse Source 
In general, TCP is a better fit for FreeIPA due to large packet sizes.

However, there is also a specific need for TCP when using OTP. If a UDP
packet is delivered to the server and the server takes longer to process
it than the client timeout (likely), the OTP value will be resent.
Unfortunately, this will cause failures or even lockouts. Switching to
TCP avoids this problem altogether.

https://fedorahosted.org/freeipa/ticket/4725

Reviewed-By: Martin Kosek <mkosek@redhat.com>
This commit is contained in:
Nathaniel McCallum 2014-12-05 11:18:55 -05:00 committed by Martin Kosek
parent d0a781b9c6
commit 7ad9f5d3d5
3 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
install/share/krb5.conf.template
View File

@ -12,6 +12,7 @@ includedir /var/lib/sss/pubconf/krb5.include.d/
rdns = false rdns = false
ticket_lifetime = 24h ticket_lifetime = 24h
forwardable = yes forwardable = yes
udp_preference_limit = 0
$OTHER_LIBDEFAULTS $OTHER_LIBDEFAULTS
[realms] [realms]
$REALM = { $REALM = {

1
install/tools/ipa-replica-conncheck
View File

@ -208,6 +208,7 @@ def configure_krb5_conf(realm, kdc, filename):
libdefaults.append({'name':'rdns', 'type':'option', 'value':'false'}) libdefaults.append({'name':'rdns', 'type':'option', 'value':'false'})
libdefaults.append({'name':'ticket_lifetime', 'type':'option', 'value':'24h'}) libdefaults.append({'name':'ticket_lifetime', 'type':'option', 'value':'24h'})
libdefaults.append({'name':'forwardable', 'type':'option', 'value':'yes'}) libdefaults.append({'name':'forwardable', 'type':'option', 'value':'yes'})
libdefaults.append({'name':'udp_preference_limit', 'type':'option', 'value':'0'})
opts.append({'name':'libdefaults', 'type':'section', 'value': libdefaults}) opts.append({'name':'libdefaults', 'type':'section', 'value': libdefaults})
opts.append({'name':'empty', 'type':'empty'}) opts.append({'name':'empty', 'type':'empty'})

1
ipa-client/ipa-install/ipa-client-install
View File

@ -1043,6 +1043,7 @@ def configure_krb5_conf(cli_realm, cli_domain, cli_server, cli_kdc, dnsok,
libopts.append({'name':'rdns', 'type':'option', 'value':'false'}) libopts.append({'name':'rdns', 'type':'option', 'value':'false'})
libopts.append({'name':'ticket_lifetime', 'type':'option', 'value':'24h'}) libopts.append({'name':'ticket_lifetime', 'type':'option', 'value':'24h'})
libopts.append({'name':'forwardable', 'type':'option', 'value':'yes'}) libopts.append({'name':'forwardable', 'type':'option', 'value':'yes'})
libopts.append({'name':'udp_preference_limit', 'type':'option', 'value':'0'})
# Configure KEYRING CCACHE if supported # Configure KEYRING CCACHE if supported
if kernel_keyring.is_persistent_keyring_supported(): if kernel_keyring.is_persistent_keyring_supported():