[2602] in SIPB-AFS-requests
Re: Kerberos server for SIPB.MIT.EDU
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Jan 6 13:46:54 1997
To: mhpower@MIT.EDU
Cc: sipb-afsreq@MIT.EDU
In-Reply-To: Your message of "Sun, 05 Jan 1997 20:41:55 EST."
<9701060141.AA18923@yaz-pistachio.MIT.EDU>
Date: Mon, 06 Jan 1997 13:46:35 EST
From: Greg Hudson <ghudson@MIT.EDU>
> I think it'd be a good idea to start running Kerberos servers for
> the SIPB.MIT.EDU realm on reynelda and ronald-ann (after the
> ronald-ann replacement). The main reason for this is that it's
> sometimes useful to get Kerberos principals for various sipb
> purposes, and it's not always either possible or appropriate to get
> these principals in the ATHENA.MIT.EDU realm.
At the moment, I side against such a proposal. I think the benefits
of having our own Kerberos realm are outweighed by the added
complexity of running a new service. I also think that the benefits
are limited in that giving AFS maintainers implicit access to the
Kerberos database would compromise maintainer-independence between AFS
and any service which would use keys in the SIPB kerberos realm.
Of course, a number of services already depend on AFS (e.g. both
bloom-picayune and penguin-lust probably run programs out of the sipb
AFS cell as root periodically). So my opinion is not all that strong,
and I wouldn't be upset or anything if consensus were against me.
