[22186] in Kerberos
Re: Question: want different default_realm for service and user
daemon@ATHENA.MIT.EDU (Dirk Pape)
Fri Aug 13 06:48:05 2004
From: Dirk Pape <pape@inf.fu-berlin.de>
Date: Fri, 13 Aug 2004 12:43:27 +0200
Message-ID: <pape-7AEF62.12432713082004@news.fu-berlin.de>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Hello,
In article <411B6408.8080202@anl.gov>,
deengert@anl.gov ("Douglas E. Engert") wrote:
> As Jeff pointed out, another approach is to start sshd with
> KRB5_CONFIG=/etc/krb5.server.conf already set.
>
> But if you also allow ssh login via Krb user and password, this
> would set the deafult realm for these user to the wrong realm.
yes, I see the problem. As far as I see pam_krb5 has no parameter to set
the realm user will be authenticated to, but allways will take it from
the conf/env.
I will see how far I come with the other hints I got, especially with
using the domain_realms section and capaths appropriately.
I am not willing to maintain a patched kerberos for all our platforms
here, so I have to wait until you patch is accepted by MIT and went into
the os-distributions (debian linux, solaris, macosx), which will take
looong time in my experience
Dirk.
--
Dr. Dirk Pape (Leiter des Rechnerbetriebs)
FB Mathematik und Informatik der FU-Berlin
Takustr. 9, 14195 Berlin
Tel. +49 (30) 838 75143, Fax. +49 (30) 838 75190
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
