[29553] in Kerberos
Re: delegating principal creation to a web process
daemon@ATHENA.MIT.EDU (Russ Allbery)
Thu Mar 20 14:55:45 2008
To: kerberos@mit.edu
In-Reply-To: <85E1907A-5B6B-4D90-AC24-A232B4453A91@sxw.org.uk> (Simon
Wilkinson's message of "Thu\, 20 Mar 2008 18\:44\:49 +0000")
From: Russ Allbery <rra@stanford.edu>
Date: Thu, 20 Mar 2008 11:54:58 -0700
Message-ID: <87tzj18bul.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Simon Wilkinson <simon@sxw.org.uk> writes:
> It's not clear from your description how you check that the script is
> creating the 'correct' account name for a particular user - nor how you
> protect against denial of service attacks, or attacks which create
> 'magic' account names (root, <blah>/ admin, anything else your site has
> in a wildcard)
http://www.eyrie.org/~eagle/software/kadmin-remctl/ may be helpful in that
respect.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
