[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: 0.6.4 krb4 / kaserver redux
On Sat, 2005-06-04 at 14:49 +0200, Love Hörnquist Åstrand wrote:
> "Brandon S. Allbery KF8NH" <allbery@ece.cmu.edu> writes:
>
> > - add automatic reauthentication to kinit
> > * unlike John Bucy's original patch for 0.6.3, this one saves the
> > password in a pipe so it's only in process memory while it's being
> > used
> > * probably a future version should get a max-renewable-life ticket
> > and renew it periodically, instead of this hack
>
> This functionallity is already in 0.7 snapshot, please test it and see that
> it does what you want.
First I need to find a way to upgrade openssl without breaking the
world :) since the 0.7 snapshots I tried didn't like openssl 0.9.6.
It'll happen eventually but not right now.
> > - su now gets (well, 524s) a krb4 ticket as well as the krb5 ticket and
> > token
> > * ideally this patch will become obsolete here when I put this stuff
> > into wide distribution, but during testing I prefer not to need to
> > kinit after su in order to connect to older systems
>
> I'm considering to include this. But can't those site admins that really
> have to deal with Kerberos 4 just type "kinit -9" ?
In our case, it's a matter of having things work as much as possible the
way they did with the krb4 world. It's bad enough that I need to keep a
krb4-based OpenSSH around on the newer systems so we can authenticate to
the old machines that aren't being upgraded to krb5....
--
brandon s. allbery [linux,solaris,freebsd,perl] allbery@kf8nh.com
system administrator [WAY too many hats] allbery@ece.cmu.edu
electrical and computer engineering, carnegie mellon univ. KF8NH