shishi_realm_for_server_dns(3)

📦
version 1.0.3 · 2 versions
  • 1.0.3 · debian bookworm, debian trixie, nixos 26.05, nixpkgs unstable, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 1.0.2 · ubuntu jammy
, in debian bookworm, debian trixie, nixos 26.05, nixpkgs unstable, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 shishi_realm_for_server_dns — the manual, bestie edition 💖

okay so you're here for shishi_realm_for_server_dns(3) from the shishi manual, and honestly? iconic of you. this is an API function, and we're gonna walk through it together, no cap. ✨

✨ NAME ✨

shishi_realm_for_server_dns — it's an API function, bestie. that's the whole vibe. 🎀

🌸 SYNOPSIS 🌸

#include <shishi.h>

char * shishi_realm_for_server_dns(Shishi * handle, char * server);

🦋 ARGUMENTS 🦋

  • Shishi * handle — the Shishi library handle, and like… you gotta make it with shishi_init() first, obviously. no handle, no service. 💅
  • char * server — the hostname you're trying to find a realm for. that's the assignment. 🔥

👑 DESCRIPTION 👑

so here's the tea: this function finds the realm for a host server using a DNS lookup, exactly as prescribed in "draft-ietf-krb-wg-krb-dns-locate-03.txt". it's giving very official, very specified. 💜

🚨 okay so real talk, this part matters: DNS lookups can be spoofed. so if you just blindly rely on the realm info you get back, you might get hit with a redirection attack. in a single-realm scenario, that only really achieves a denial of service — annoying, but contained. but with trust across multiple realms?? the attack can literally redirect you to a compromised realm. not the vibe. 😭

because of that whole situation, Shishi prints a warning, suggesting you should instead add a proper 'server-realm' configuration token. do that. it's the glow-up your config deserves. 💖

to illustrate the DNS information used, here's an extract from a zone file for the domain ASDF.COM:

_kerberos.asdf.com.             IN   TXT     "ASDF.COM"
_kerberos.mrkserver.asdf.com.   IN   TXT     "MARKETING.ASDF.COM"
_kerberos.salesserver.asdf.com. IN   TXT     "SALES.ASDF.COM"

okay so let's say, hypothetically, a client wants to use a service on the host "foo.asdf.com". first move: it would query for

_kerberos.foo.asdf.com.  IN TXT

no match? tragic. so then it would query for

_kerberos.asdf.com.      IN TXT

and with the resource records stated above, that second query comes back with a positive answer. slay. 🎉

⭐ RETURN VALUE ⭐

returns the realm for the indicated host, or NULL if no relevant TXT record could be found. simple as that, fr fr. 🙈

💀 REPORTING BUGS 💀

found a bug? report it to <bug-shishi@gnu.org>. don't be shy, they wanna hear it. 🫶

Copyright © 2002-2022 Simon Josefsson.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. (yes queen, keep the notice. it's the rules. 📜)

🧚 SEE ALSO 🧚

the full documentation for shishi is maintained as a Texinfo manual. if the info and shishi programs are properly installed at your site, the command

info shishi

should give you access to the complete manual. go read it, it's giving main character energy. 👑

and that's the whole page, bestie!! 💜 this was shishi_realm_for_server_dns(3) from shishi version 1.0.3. now go configure your realms properly and stay safe out there. mwah. 💅✨

📦 where this page comes from