[23434] in Kerberos
Re: afs to k5 conversion keytypes
daemon@ATHENA.MIT.EDU (Ken Hornstein)
Tue Feb 22 15:28:03 2005
Message-Id: <200502222027.j1MKR6CY001283@ginger.cmf.nrl.navy.mil>
To: kerberos@mit.edu
In-Reply-To: <Pine.LNX.4.44.0502211629180.24138-100000@osage.ncsa.uiuc.edu>
Date: Tue, 22 Feb 2005 15:27:06 -0500
From: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Errors-To: kerberos-bounces@mit.edu
>To my knowledge there is no way to convert keys like you're wanting to do.
>My suggestion, if it's possible in your environment, would be to implement
>a password expiration policy with a deadline of a few months and let
>everyone gradually change their password.
Thewre is one way ... but it requires you to have your Kerberos Shit
Together.
Write a custom login program that once you login correctly using an AFS
salted key, generates a V5 salted key from that plaintext password and
stores it somewhere. "Somewhere" could be in a V5 database (e.g., you
can simply force a password change). This means not only would you
have to know how to program the poorly-documented Kerberos API, but you
would have to figure out how to program the even-more-poorly-documented
kadm5 API.
I have seen other variations on this, but it's all basically, "Get the user
to enter in a plaintext password to some login-like program, validate it,
and then generate a V5 key from it". Sadly, the intersection of people
who have their Kerberos Shit Together and people who actually _need_ this
functionality is currently the null set.
--Ken
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
