[2315] in Kerberos
Re: kerberizing xlock ???
daemon@ATHENA.MIT.EDU (Barry Jaspan)
Thu Oct 29 16:23:52 1992
Date: Thu, 29 Oct 92 15:48:34 -0500
From: "Barry Jaspan" <bjaspan@Athena.MIT.EDU>
To: Steve Lunt <lunt@ctt.bellcore.com>
Cc: kerberos@Athena.MIT.EDU
In-Reply-To: [2314]
From: robinson@cmf.nrl.navy.mil
Date: Thu, 29 Oct 92 13:21:00 EST
I got some forwarded e-mail asking about kerborized xlock ... The
source is in:
/afs/cmf.nrl.navy.mil/X11R4/src/local/xlock
Just for everyone's information: The modified xlock.c in this
directory (k_xlock.c) uses an AFS kaserver function and header files,
not MIT Kerberos. You cannot build it unless you have AFS.
Date: Thu, 29 Oct 92 13:44:40 EST
From: Steve Lunt <lunt@ctt.bellcore.com>
The comments in the FAQ certainly apply to `login', but I use a
Kerberized xlock primarily to ensure I always have a fresh ticket
cache. I am not in this case worried about the spoofing that could
occur.
If that is the functionality you want, then of course your patches
suffice. But I'm curious: if you are not worried about someone
gaining physical access to your machine, why do you run xlock at all?
You could achieve the same effect by running "kinit" when you get back
to your workstation after being away for a while. I suspect that you
do actually care about spoofing or you would just leave your machine
wide open when you leave. (Of course, that is actually what you are
doing..)
Your patches make me uncomfortable because a less knowledgeable user
is likely to use them thinking they provide security when they do not
("Gee, it uses Kerberos, it must be more secure."). Perhaps you could
distribute them with a README file explaining the purpose for which
the patches are intended, and their drawbacks.
Barry Jaspan
