[2295] in Kerberos
Re: DEC Ultrix kerberos
daemon@ATHENA.MIT.EDU (Shawn Mamros)
Tue Oct 20 15:01:21 1992
Date: 19 Oct 92 22:00:03 GMT
From: mamros@athena.lkg.dec.com (Shawn Mamros)
Reply-To: mamros@athena.lkg.dec.com (Shawn Mamros)
To: kerberos@shelby.Stanford.EDU
The ULTRIX-supplied Kerberos places its ticket files in the directory
/var/dss/kerberos/tkt, rather than in /tmp. The default protection on
this directory is 755 (owned by root), so users other than root won't be
able to create ticket files (unless you set the KRBTKFILE environment
variable before the kinit). If you want the default ticket file location
to work for mortal users, either change the directory protection to 1777
(don't forget the sticky bit, please!), or remove the directory and make
it a symbolic link to /tmp.
Before anyone asks, "why did DEC do this?", it should be understood that
the sole supported use of the Kerberos supplied with ULTRIX V4.x is to
allow ULTRIX enhanced security to be able to work in a distributed manner
through authenticated name service lookups, which in turn relies on client-
to-server machine authentication. Individual users aren't given Kerberos
principals under ULTRIX enhanced security - note, in fact, that the ULTRIX
kinit(1) man page states that "user-level authentication is not supported".
That being said, I've seen the ULTRIX-supplied Kerberos work just fine for
user-level authentication in many circumstances (once you get over the
directory protection business) - whether or not it will work for you depends
on what you're trying to do.
Disclaimer: I have nothing to do with ULTRIX engineering or maintenance,
so please don't shoot the messenger...
-Shawn Mamros
E-mail to: mamros@athena.lkg.dec.com
