[22642] in Kerberos
Re: Kerberos behind load balancer?
daemon@ATHENA.MIT.EDU (Frank Cusack)
Wed Oct 6 14:46:39 2004
From: Frank Cusack <fcusack@fcusack.com>
Date: Wed, 06 Oct 2004 11:34:04 -0700
Message-ID: <m37jq3u25f.fsf@magma.savecore.net>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Wed, 6 Oct 2004 12:54:27 +0000 (UTC) jthardy@uta.edu (Jason T Hardy) wrote:
> I can't modify DNS.
Ah, well then that's a crazy restriction (since as a sysadmin, one
with a load balancer at your disposal, you can almost certainly spoof
DNS and make it do what you want anyway. I doubt you use TSIGs even
internally). But given that restriction, yeah load balancing sounds
reasonable.
But let's be clear, it doesn't "allow" you to do things as you
described earlier in the sense that you couldn't do them anyway; MIT
krb5 out of the box allows you to do those things.
>> The load balancer is simply another failure point.
>
> As is everything else.
However load balancers are complicated devices and more prone to failure.
/fc
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
