[29398] in Kerberos
Re: GSSAPI Key Exchange Patch for OpenSSH 4.7p1
daemon@ATHENA.MIT.EDU (Russ Allbery)
Fri Feb 29 22:16:15 2008
To: Matthew Andrews <matt@slackers.net>
In-Reply-To: <47C8C55C.4020706@slackers.net> (Matthew Andrews's message of
"Fri\, 29 Feb 2008 18\:54\:20 -0800")
From: Russ Allbery <rra@stanford.edu>
Date: Fri, 29 Feb 2008 19:12:01 -0800
Message-ID: <87mypj2l4u.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: openssh-unix-dev@mindrot.org, heimdal-discuss@sics.se, kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Matthew Andrews <matt@slackers.net> writes:
> Hmmm.... The cascading credentials code sounds interesting, but raises
> the practical question of how does one deal with derived credentials.
> For example some sites configure the pam_session code to use delegated
> krb5 credentials to acquire additional credentials such as afs tokens,
> or x509 certificates. Since there would be no new session created, these
> derived credentials would not get refreshed.
Just re-run the session PAM stack with PAM_REFRESH_CREDS set, the same as
what a screensaver would do. This does all the right things with derived
credentials if your PAM modules are properly written.
> I think you'd need some way to hook site specific actions into the
> refresh activity, and of course that raises the hairy problem whether
> this refresh activity occurs in the same process, or one of it's
> descendants where the pam_session was established.
You do have to run pam_session in the right place, yes.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
