[2390] in Kerberos
Kerberos on multi-homed hosts.
daemon@ATHENA.MIT.EDU (Scott Dawson)
Mon Nov 23 15:45:56 1992
To: kerberos@Athena.MIT.EDU
Cc: sdawson@engin.umich.edu
Date: Mon, 23 Nov 92 12:57:58 -0500
From: Scott Dawson <sdawson@engin.umich.edu>
I am having problems with kerberos client stuff on multi-homed hosts.
Here's my situation. I have kerberos running on several machines
which have ethernet and FDDI interfaces, and have the problem that
I acquire my tickets through the FDDI interface but when I present
them I sometimes do so through my ethernet interface. The server
which I present the ticket to then thinks that it is bogus because
the address I am coming from doesn't match the address in the ticket.
I need a way for the server to recognize that the address in the ticket
and the address of the interface that I am coming from are associated with
the same host. The only ways that I can think of to do this are:
1. Use nameservice. This is insecure because you may not
necessarily trust the nameserver.
2. Have an equivalency list on the local host. This doesn't scale
well, nor can you know about all machines which might try to
connect to your service.
Is there a kerberized nameserver or a better method that someone is
using right now? Even examples of the above would be appreciated.
Thanks in advance,
-Scott Dawson
