Simon Josefsson’s blog

Version -08 only fixes very minor WGLC comments.

Nothing to see really, but it marks progress for the document.

I made a new release of libntlm today. There are no feature changes, just an update of gnulib files which offers better portability (hopefully including Mac OS X now).

I also noticed that I was not subscribed to the libntlm mailing list. Bad maintainer.

Building on my earlier efforts to document the ccache format, I’ve now created the krb5dissect tool. It will parse your Kerberos ccache file (typically /tmp/krb5cc_$UID) and prints it in a human readable format.

This tool was written in about 1 hour, given the amazing amount of nice modules available from gnulib, and helpful tools such as gengetopt and help2man. Kudos!

Update! Version 2.0 can do the same for Kerberos keytab files (typically /etc/krb5.keytab).

Cypak recently launched their new authentication devices LoginKey. I did a security review of it, and it uses a per-device AES-128 key to encrypt information. It emulates a USB keyboard, so it works fine under Windows, Linux and Mac OS X.

I finally took the time to update the Kerberos V5 over TLS document. After submitting the new -01 document, I had a look at the -00 version and it was published around two years ago, yikes.

Krb5starttls draft.

Reading MIT/Heimdal Kerberos V5 credential files seemed like a good first step towards making Shishi more usable. Users will be able to continue using their existing Kerberos V5 applications and libraries, but will be able to gradually move to Shishi. This has actually been on the todo-list for Shishi since day one. A few months ago, Michael B Allen wrote up a specification of the keytab file format (i.e., the file format used by /etc/krb5.keytab), and I implemented it in Shishi. Now, that file contains hostkeys, and is thus only useful for servers. To be able to read the end-user credential files would be more useful. I fired up M-x hexl-find-file RET on /tmp/krb5cc_1000, and with the help of Michael’s prior work, I came up with the following file format description and basic implementation.

Kerberos ccache file format writeup

Parse ccache files, header file

Parse ccache files, source