New in v1_3a:

+ Fixed rsh client so it will not confuse SO_KEEPALIVE with SO_DEBUG on
  Linux.  (Although I suspect Linux is breaking some POSIX spec or other.)

+ Found and fixed an erroneous free() in the portal-mode code in login.krb5.
  A small subset of IRIX machines suffered a delayed core dump in malloc()
  because of it.

+ Raised a couple of hard-coded limits on the length of a username to quiet
  grumpy users who nonetheless are out of their own OS vendor's spec in
  having usernames longer than 8 characters!  (See "man 4 passwd" on IRIX.)

+ Split the "ups add-new-realm" action into two parts, allowing the
  installer to update krb5.conf and the keytabs without touching the
  .k5login files.

+ When doing a new installation, try to add hostkeys for both realms with
  the same password, but consider it a success if either realm works.

================================================================

New in v1_3:

The changes from v1_2 are extrememly minor

+ Fixed a problem in doing DNS lookups to determine the kerberos realm of
  a remote host, and in guessing the default realm when neither the host
  nor the host's domain are found in /etc/krb5.conf.

+ On IRIX, the .k5login files mysteriously weren't getting updated by
  add-new-realm.  That *might* be fixed now.

+ Added two UPS actions, install-pilot and install-keep-ssh-pilot, which
  cause a new Kerberos system to go into the PILOT.FNAL.GOV realm instead
  of the production realm FNAL.GOV.  Use this *only* if you're part of a
  pilot project workgroup that hasn't made the switch yet!

+ Some of the README files concerning non-ups installation were updated,
  and the RELEASE-NOTE files were merged into one.

+ A bit less minor, perhaps: since forever, the Kerberos login program
  has not checked the .k5login file, which makes a difference if it is
  accepting a Kerberos password or a Cryptocard response.  Now it will
  check.

================================================================

New in v1_2:

+ The source code and long-form documentation are now in a separate,
  NULL-flavored distribution file with qualifier "source".

+ Tools to aid migration to the production realm FNAL.GOV.  (See
  keytab-convert and ups actions add-new-realm and change-realm.)

+ It's now possible for a krb5.conf auth_to_local "RULE" to inspect the realm
  of the client principal.  This makes it possible to map multiple realms
  automatically for kuserok(), so users with no other need for a .k5login file
  don't need to create one just for the realm transition.

+ klogind puts the client principal in $KRB5CLIENT like kshd does.

+ kadmin would not run on SunOS+5.8 due to missing libs.  Should be fixed now.

+ rsh now sets SO_KEEPALIVE unless "-K" is given.  rcp always does.

+ Some possible buffer-overflow vulnerabilities in ftpd are fixed.

+ DNS is now consulted as well as krb5.conf when determining the realm of
  a host.

+ The Kerberos login program will issue a password expiration warning, if
  applicable.  (kinit already does if the feature is enabled on the KDC, which
  it now is.)

+ The installation process will more reliably find the inetd and sshd
  processes for SIGHUP purposes.

+ kprop will now try all addresses of a multihomed slave KDC.

================================================================

New in v1_1:

+ login.krb5 updates utmpx if supported.

+ kshd puts client principal in $KRB5CLIENT (mainly for CVS servers).

+ kadmin's cryptocard-programming code now uses the API from Cryptocard
  rather than a reverse-engineered series of steps.

+ KDC immunized against a certain inadvertent DOS attack by Heimdal's POP
  server.

+ Fixed a double-free error in krb524.

+ GNU make no longer required to build kadmind.

+ "amanda" service added to 524 translation list, just in case.

================================================================

FERMI KERBEROS VERSION v1_0 RELEASE NOTE

Primary new feature in v1_0: "portal mode" ftp.
    This allows ftp authentication with a Cryptocard in lieu of a
    password, as has been available for telnet logins since v0_4.

Also added in v1_0:
    ftpd will accept forwarded credentials and run aklog if so
    directed by /etc/krb5.conf.

    Some command line flags which were previously not documented now
    are.

Previous important fixes and features:

    v0_7 fixed a botch in the rsh client which would mingle encrypted
    stdout and stderr streams in heavy traffic.

    v0_7 added support for the "proxy_gateway" item in [libdefaults],
    which makes the most simple case of NAT slightly less vile.