[29402] in Kerberos
Re: GSSAPI Key Exchange Patch for OpenSSH 4.7p1
daemon@ATHENA.MIT.EDU (Simon Wilkinson)
Sat Mar 1 07:07:56 2008
In-Reply-To: <87mypj2l4u.fsf@windlord.stanford.edu>
Mime-Version: 1.0 (Apple Message framework v752.3)
Message-Id: <76A8CC04-E1B6-45EE-B8E8-09C51303D293@sxw.org.uk>
From: Simon Wilkinson <simon@sxw.org.uk>
Date: Sat, 1 Mar 2008 12:06:41 +0000
To: Russ Allbery <rra@stanford.edu>
Cc: heimdal-discuss@sics.se, openssh-unix-dev@mindrot.org, kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 1 Mar 2008, at 03:12, Russ Allbery wrote:
> Matthew Andrews <matt@slackers.net> writes:
>
>> Hmmm.... The cascading credentials code sounds interesting, but
>> raises
>> the practical question of how does one deal with derived credentials.
>>
> Just re-run the session PAM stack with PAM_REFRESH_CREDS set, the
> same as
> what a screensaver would do. This does all the right things with
> derived
> credentials if your PAM modules are properly written.
This is exactly what my cascading credentials code for OpenSSH does.
It uses an additional PAM stack (so you can set different options
than the 'main' ssh PAM stack) which it calls the session layer of
whenever credentials are renewed. We use this to renew both AFS
tokens, and KX509 certificates.
Informatics are now running this code in production. I expect to be
making a public release next week.
Cheers,
Simon.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
