[22720] in Kerberos
Re: User instances
daemon@ATHENA.MIT.EDU (Rachel Elizabeth Dillon)
Thu Oct 21 19:47:02 2004
Date: Thu, 21 Oct 2004 19:45:47 -0400
From: Rachel Elizabeth Dillon <red@mit.edu>
To: Fredrik Tolf <fredrik@dolda2000.com>
Message-ID: <20041021234547.GH2493@yiff.mit.edu>
Mime-Version: 1.0
In-Reply-To: <1098393635.7857.16.camel@pc7.dolda2000.com>
cc: kerberos@mit.edu
Content-Type: multipart/mixed; boundary="===============13439549696008379=="
Errors-To: kerberos-bounces@mit.edu
--===============13439549696008379==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="xGGVyNQdqA79rdfn"
Content-Disposition: inline
--xGGVyNQdqA79rdfn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
There are a couple of things that I havs seen as common across multiple
realms; username/admin principals tend to be principals with full=20
administrative rights in kadmin, and username/root principals tend to
be principals with additional privileges you want the user to have to
remember to turn on specifically. I personally find that any other
instances tend to be mostly confusing, as the average user does not
want to have to deal with instances, but I am sure different people
have different opinions of "not ugly." If you do want to do this,=20
you probably want to look at the man page for kadmind, specifically the
ACL FILE SYNTAX section, in order to determine how to give your users
the permissions you want them to have. It looks like a line like this:
username/*@REALM.COM x username/*@REALM.COM
will give users full permissions on any principals with their username,
but I recommend not just using this line for a couple of reasons:
* You may not want them to be able to delete their own principal, which
would just get irritating.
* If you use the basic */admin * line which allows any principal with
an admin instance full access to the KDC, any user with two malicious
neurons to fire against each other can eventually figure out how to
get an /admin principal and do nasty things.
* If you want to manage things like password expiry, users can circumvent
you at the KDC level.
I personally think this is a bad idea, but not knowing anything about
your situation, that judgment seems arbitrary. "What are you really
trying to do?" :)
Hope this helps,
-r.
On Thu, Oct 21, 2004 at 11:20:35PM +0200, Fredrik Tolf wrote:
> I've got three short questions about instances:
>=20
> Is there a standardization for what instances mean for user principals?
> If not, would it be OK (OK as in "not ugly") to enable users to create
> new principals with their own name, but different instances? If so, is
> there a way to make the MIT KDC allow users to do this?
>=20
> Thanks for your time!
>=20
> Fredrik Tolf
>=20
>=20
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
--xGGVyNQdqA79rdfn
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFBeEorrAG/UVUP/b0RApvpAJ4iokxCVrn1by1pvwXqgGv3yWUELACdE80X
cwm+FUxqXqlTjot0aRGW/io=
=huKq
-----END PGP SIGNATURE-----
--xGGVyNQdqA79rdfn--
--===============13439549696008379==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============13439549696008379==--
