[22553] in Kerberos
Re: MIT KDC only listening on lo
daemon@ATHENA.MIT.EDU (Sam Hartman)
Thu Sep 23 13:54:49 2004
To: Fredrik Tolf <fredrik@dolda2000.com>
From: Sam Hartman <hartmans@mit.edu>
Date: Thu, 23 Sep 2004 13:49:06 -0400
In-Reply-To: <1095893439.26766.49.camel@pc7.dolda2000.com> (Fredrik Tolf's
message of "Thu, 23 Sep 2004 00:50:38 +0200")
Message-ID: <tslsm98ub8t.fsf@cz.mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
>>>>> "Fredrik" == Fredrik Tolf <fredrik@dolda2000.com> writes:
>> This comes up often enough that I'm thinking we should
>> reconsider our decision not to listen on localhost.
Fredrik> Would you mind me asking why you made that decision in
Fredrik> the first place? I can see no obvious reason for it.
If you are using IP addresses in your tickets, you want to make sure
that you never talk to the KDC on localhost. Also, you want to make
sure you never include localhost in the set of addresses in your
ticket. I think we use the same API to find local addresses to
include in tickets as we do to find local interfaces.
--Sam
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
