[23118] in Kerberos
Re: kadmin can't use TGT based?
daemon@ATHENA.MIT.EDU (Mark Roach)
Tue Jan 4 20:23:44 2005
From: Mark Roach <mrroach@okmaybe.com>
Message-Id: <pan.2005.01.05.00.00.57.594692@okmaybe.com>
Date: Wed, 05 Jan 2005 00:01:02 GMT
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Tue, 04 Jan 2005 15:36:23 -0500, Sam Hartman wrote:
>>>>>> "Chaskiel" == Chaskiel M Grundman <cg2v@andrew.cmu.edu> writes:
> Chaskiel> If your realm is set up properly, then yes. It is proper
> Chaskiel> practice to set DISALLOW_TGT_BASED on the kadmin/admin,
> Chaskiel> kadmin/changepw, and changepw/kerberos service
> Chaskiel> principals. that is however a policy decision, not
> Chaskiel> anything that is fixed in the protocol.
>
> Well, I think the MIT kadmind actually enforces this itself even if
> you don't set the KDC policy.
I think this must be true (I haven't yet checked the source) as some of my
user/admin principals do not have that flag set, but it still shows in the
logs.
Thank you both for your responses.
-Mark
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
