[19179] in Kerberos
Re: Keytabs in Kerberos
daemon@ATHENA.MIT.EDU (Booker Bense)
Fri May 2 17:21:26 2003
Date: Fri, 02 May 2003 14:20:32 -0700 (PDT)
From: Booker Bense <bbense@SLAC.Stanford.EDU>
In-reply-to: <tx1issuqrb0.fsf@mit.edu>
To: Ken Raeburn <raeburn@mit.edu>
Message-id: <Pine.LNX.4.55.0305021414270.4931@telemark.slac.stanford.edu>
MIME-version: 1.0
Content-type: TEXT/PLAIN; charset=US-ASCII
Content-transfer-encoding: 7BIT
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Thu, 1 May 2003, Ken Raeburn wrote:
> silvio@gdora.com.br (Silvio Fonseca) writes:
> > There's a way to use a "personal" keytab, I mean, how I make
> > the kerberized programs to look for keytabs not only in
> > /etc/krb5.keytab but to others files as well (something like a
> > failover in keytabs to look first for the system-wide file and then
> > to the personal one).
>
> That's something that I think should be made configurable someday,
> without requiring environment variables or anything like that just to
> be able to run a server as a non-root user. I'm not sure how it should
> be set up though. Perhaps some data in krb5.conf mapping the
> principal name to the keytab name, like:
>
> [libdefaults]
> keytabs = {
> host/* = KEYTAB:/etc/krb5.keytab
> ftp/* = KEYTAB:/etc/ftp.keytab
> imap/* = KEYTAB:/etc/imapd/keytab
> pop/* = SRVTAB:/etc/pop.srvtab
> */* = KEYTAB:/etc/krb5.keytab
> * = KEYTAB:~/.k5keytab
> }
>
> Just an idea....
- Doesn't it make more sense for this to go in the appdefaults
section? Or maybe not, since it's being used by the library
api and not the applications....
- Booker C. Bense
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
