[22214] in Kerberos
Re: keytab vs database
daemon@ATHENA.MIT.EDU (Sam Hartman)
Tue Aug 17 13:09:14 2004
To: Lara Adianto <m1r4cle_26@yahoo.com>
From: Sam Hartman <hartmans@mit.edu>
Date: Tue, 17 Aug 2004 13:07:13 -0400
In-Reply-To: <20040817092737.66342.qmail@web50202.mail.yahoo.com> (Lara
Adianto's message of "Tue, 17 Aug 2004 02:27:37 -0700 (PDT)")
Message-ID: <tslwtzxn16m.fsf@cz.mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
>>>>> "Lara" == Lara Adianto <m1r4cle_26@yahoo.com> writes:
Lara> Hi, I have a basic question about kerberos concept. As I
Lara> browsed through MIT source code to better understand how
Lara> kerberos works, I noticed that in processing the tgs
Lara> request, the ticket is always decrypted using server's key
Lara> retrieved from keytab. If the server is a TGS service
Lara> (krbtgt) or kadmin/changepw which are part of a KDC (am I
Lara> right to say this ?), is it okay to retrieve the key from
Lara> the database instead of from the keytab ?
Lara> Does a KDC need to maintain a keytab actually ?
No, and MIT does not. There is a special glue layer between the
keytab abstraction and the database. b If you happen to be running
inside the KDC process, there is a special keytab implementation that
looks up keys in the database rather than in a file. Look at
src/lib/kdb/keytab.c.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
