pull up r24584 from trunk

 ------------------------------------------------------------------------
 r24584 | tlyu | 2010-12-20 17:52:35 -0500 (Mon, 20 Dec 2010) | 6 lines

 ticket: 6794
 tags: pullup
 target_version: 1.9

 Document rdns libdefault setting.

ticket: 6794
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24585 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/doc/admin.texinfo b/doc/admin.texinfo
index 0c5325466f634738ee82c9be745a53dbc5a687de..5051b5d3f794dd69331ddc070a6c5fc2d3db72d3 100644 (file)
--- a/doc/admin.texinfo
+++ b/doc/admin.texinfo
@@ -615,6 +615,13 @@ The default value for this flag is @value{DefaultForwardable}.
 If this flag is set, initial tickets by default will be proxiable.
 The default value for this flag is @value{DefaultProxiable}.
 
+@itemx rdns
+If set to false, prevent the use of reverse DNS resolution when
+translating hostnames into service principal names.  Defaults to
+true.  Setting this flag to false is more secure, but may force
+users to exclusively use fully qualified domain names when
+authenticating to services.
+
 @end table
 
 

diff --git a/src/config-files/krb5.conf.M b/src/config-files/krb5.conf.M
index d03a1f468b7316e7d0a47bcacc205bd052e1fc82..df62d4d524b454838575a34db997cb6ac0512013 100644 (file)
--- a/src/config-files/krb5.conf.M
+++ b/src/config-files/krb5.conf.M
@@ -18,7 +18,7 @@
 .\" M.I.T. makes no representations about the suitability of
 .\" this software for any purpose.  It is provided "as is" without express
 .\" or implied warranty.
-.\" "
+.\"
 .TH KRB5.CONF 5
 .SH NAME
 krb5.conf \- Kerberos configuration file
@@ -268,6 +268,13 @@ The default value for this flag is false.
 If this flag is set, initial tickets by default will be proxiable.
 The default value for this flag is false.
 
+.IP rdns
+If set to false, prevent the use of reverse DNS resolution when
+translating hostnames into service principal names.  Defaults to
+true.  Setting this flag to false is more secure, but may force
+users to exclusively use fully qualified domain names when
+authenticating to services.
+
 .SH APPDEFAULTS SECTION
 
 Each tag in the [appdefaults] section names a Kerberos V5 application