1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
Release 0.5.1:
- Add --keytab-auth-as option (thanks Andrew Deason)
- Add --allow-weak-crypto switch, to support single DES (thanks Andrew
Deason and Mark Pröhl)
- If servicePrincipalName begins with "HOST/", rewrite to "host/"
(thanks Boleslaw Tokarski for the report)
- msktutil manual page fixes (thanks Andrew Deason and Mark Pröhl)
- Fix possible samAccountName corruption bug with uniniatialized
variables (thanks Jaroslaw Polok for the report)
- Adjust --precreate to match ADUC's behavior with long account names
(thanks Erik de Vries)
- Build fixes for HPUX and NetBSD
- Fix issue with private glibc function on RHEL5 (thanks Daniel Kobras)
- Incorporate hardening patches from Debian (thanks Tony Mancill)
- Delete "debian" directory (this will be maintained downstream)
Release 0.5:
- New co-maintainer, Olaf Flebbe
- Support service accounts in addition to computer accounts
- Add option to set the samba secret password
- Add option ("--realm") to specify a custom realm
- Various build fixes
- Add support for clients behind a NAT firewall
Release 0.4.2:
- New co-maintainer, Mark Pröhl
- Increase computer name character limit from 18 to 19 characters,
matching AD's own limits.
- Add option ("-N") to disable reverse lookups on DCs
- Add option ("--old-account-password") to use the old computer account
password to create a new keytab on a host.
- Return the proper error code when krb5_change_password fails.
- Better autodetection for krb5-config location.
- Compatibility with autoconf >= 2.68.
- Build fixes for Red Hat and Ubuntu.
- Update documentation for single-DES and AFS.
Release 0.4.1:
- Ken Dreyer took over maintainance, based upon master at
http://repo.or.cz/w/msktutil.git
- Build fixes for Red Hat
Release 0.4:
- James Y Knight took over maintainance, based upon msktutil_0.3.16-7
downloaded from: http://download.systemimager.org/~finley/msktutil/
- Made most functionality work properly with only the machine account
credentials.
- Adds COMPUTERNAME$ to the keytab, and authenticates with that, so
that setting userPrincipalName to host/COMPUTERNAME.DOMAIN@REALM
isn't necessary. (since userPrincipalName isn't settable without
admin perms)
- Now attempts to authenticate with the default machine account
password so that AD "reset account" is functional.
- Gets the default LDAP OU to create new machines in from the magic
GUID from AD, instead of assuming CN=Computers.
- Added --precreate option to allow an administrator to script
creation of accounts without touching a local keytab.
- Added --auto-update for use from a crontab to auto-rotate password.
- No longer attempts to disable password expiry by default: So note,
you need to either run --auto-update from cron or else pass the
(new) argument --dont-expire-password when creating the account.
- Added --remove-service argument.
- Fixed old kvno expiration policy so that it keeps old principals
around in the keytab for a week, instead of just keeping the
immediately-prior kvno.
- Disabled use of DES keys by default. You will have to explicitly
request them with --enctypes if you want them.
- Removed --des-only option, you can use --enctypes if you really want
to use single DES. (which, of course, you shouldn't, given that it's
now 2010 and Single DES was known to be utterly broken for over 10
years by now!)
- Fixed salting to lowercase the account name, as the AD server does.
- Switched languages from C to C++.
- Lots of other cleanup and various bugfixes.
****
Changelog of non-packaging changes from previous releases:
msktutil 0.3.16-7
* fix keytab bug in 0.3.16-6
-- Doug Engert <deengert@anl.gov> Fri, 17 Apr 2009 10:48:00 -0500
msktutil 0.3.16-6
* Work with W2008 without hotfix 951191
* SASL ssf varied depending on TLS to circumvent another W2008 bug
* added --enctypes N where N is defind with W2008
http://msdn.microsoft.com/en-us/library/cc223853(PROT.10).aspx
msDs-supportedEncrtptionTypes. 1=DES, 2=DES, 4=RC4,
8=AES128 16=AES256. N is sum of these.
* Use /dev/urandom and 63 character password.
* --verbose --verbose turns on LDAP debugging
* #ifdef for use with Solairs LDAP
* Cleanup of other ldap code and error handing
* msktutil.interactive updated to work on Solaris and use msktutil
from same directory.
-- Doug Engert <deengert@anl.gov> Tue, 14 Apr 2009 11:16:53 -0500
msktutil (0.3.16-5)
* Updated msktutil.interactive example script.
-- Brian Elliott Finley <brian@thefinleys.com> Mon, 07 Aug 2006 16:59:24 -0500
msktutil (0.3.16-4)
* Updated msktutil.interactive example script.
-- Brian Elliott Finley <brian@thefinleys.com> Thu, 27 Jul 2006 16:31:17 -0500
|
