[23734] in Kerberos
Re: replay cache proposal
daemon@ATHENA.MIT.EDU (Jeffrey Altman)
Tue Apr 19 10:47:25 2005
From: Jeffrey Altman <jaltman2@nyc.rr.com>
Message-ID: <pK89e.7775$n93.6809@twister.nyc.rr.com>
Date: Tue, 19 Apr 2005 14:39:17 GMT
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Pitrich, Karl wrote:
> Hi,
>
> I encounter problems with the replay cache on the client side
> while using a SPNEGO auth module for apache.
>
> The replay cache, per default, gets persisted in files.
> Under heavy load, the replay cache runs out of FD's ('to many open
> files').
>
> Further, when using multiple kerberized Webservices on one machine
> for concurrent access by one webclient(user), the replay cache becomes
> effective, because it is system global, which is IMHO not correct
> default behaviour.
>
> IMHO it would be better to make the replay cache configurable at runtime
> via environment variable (KRB_RC_INMEMORY).
>
>
> If you concur to this proposal, I'll submit a patch shortly.
>
>
> greetings,
>
> / Karl
Karl:
While an in-memory replay cache certainly does have some potential uses,
the replay cache must be able to survive the restart of a process or the
system. It is important that when the web server is restarted that it
not suddenly become vulnerable to replay attacks.
It is also important that if there are multiple processes running that
are all sharing the same service principal (e.g. host/fqdn@REALM) that
they all have access to the same replay cache.
That being said, are you sure the problem with running out of file
descriptors is specific to the replay cache? I have often found that
Linux systems are configured with too few file descriptors when running
Apache. I most often saw the problem with database access from Apache.
Tuning the system is often necessary.
Jeffrey Altman
--
-----------------
This e-mail account is not read on a regular basis.
Please send private responses to jaltman at mit dot edu
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
