krb5 bugfix update

Updated krb5 packages that fix multiple bugs are now available for Red Hat
Enterprise Linux 6.

Kerberos is a network authentication system which allows clients and servers to
authenticate to each other using symmetric encryption and a trusted third-party,
the Key Distribution Center (KDC).

Kerberos has been upgraded to version 1.9, which provides a number of bug fixes
over the previous version. (BZ#642417)

This update fixes the following bugs:

* Previously, no IPv6 suport was available for kprop, kpropd, kadmin and
kadmind. This update adds IPv6 support to these utilities. (BZ#595841,
BZ#595842)

* Previously, the krbPwdExpiration attribute in the principal's entry would
often be ignored when the realm database was stored in a directory server. This
update fixes this problem and this attribute is no longer ignored. (BZ#627039)

* Previously, kinit with smart card login did not authenticate to the KDC
correctly if the certificate on the smart card did not contain a subjectAltName
extension or multiple certificates were available and krb5.conf was configured
to select according to the value of the keyUsage extension in the certificates.
This update continues to look for certificates with the right extension and
corrects the valuation. (BZ#629022)

* Previously, the init script for the kpropd was not Linux Standards Base (LSB)
compliant. With this update, this init script is LSB compliant. (BZ#630587)

* Previously, the KDC log files were not rotated by default. This update
corrects this problem. Now these log files are rotated correctly. (BZ#630968)

* Previously, logins failed if the user had a .k5login file which did not
explicitly contain the user's principal name. With this update, this check can
be disabled using the "k5login_authoritative" setting in krb5.conf. (BZ#646499)

* Previously, GSSAPI authentication from Windows clients using cross-realm
authentication failed if the client's ticket included a Privilege Attribute
Certificate (PAC) with a failed signature check. Failed signature checks are now
ignored. (BZ#679612)

All krb5 users are advised to upgrade to these updated packages, which fix these
bugs.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259/

595841 - krb5's kprop/kpropd needs to support IPv6 connections
595842 - krb5's libgssrpc/kadmin/kadmind needs to support IPv6 connections
627039 - Incorrect handling of password expiration
629022 - 'kinit' with smart card login fails to authenticate to the kdc using the cert and its private key.
630968 - Kerberos server log does not get rotated
636985 - A KDC which offers PKINIT preauthentication may not accept requests from a RHEL 5 client
642417 - Rebase Kerberos to 1.9
646499 - pam_krb5 requires self principal to be listed in .k5login