[32491] in Kerberos
Re: Excessive TGS_REQ krbtgt/REALM@REALM (Possible misbehaviour in
daemon@ATHENA.MIT.EDU (Russ Allbery)
Tue Jul 6 22:50:54 2010
From: Russ Allbery <rra@stanford.edu>
To: kerberos@mit.edu
In-Reply-To: <AANLkTimgst20C8CwxZSjI0RmTHEIfU4U6T6sK5qjgJqj@mail.gmail.com>
(Michael van Dijk's message of "Wed, 7 Jul 2010 01:43:52 +0200")
Date: Tue, 06 Jul 2010 19:50:48 -0700
Message-ID: <874ogcgg3b.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Michael van Dijk <pavlovski@gmail.com> writes:
> Now for the possible 'misbehaviour'
> Repeating the same actions (making an SSH connection from kerberized SSH
> client to kerberized SSH server) from 'Linux Slackware client A' to
> 'Linux Slackware SSH server A' generates a TGS_REQ for
> krbtgt/REALM@REALM every time a new SSH connection is initiated to
> 'Linux Slackware SSH server A'. The same goes for SSH Putty connections
> from 'Windows XP client A' to 'Linux Slackware SSH server A'. Every new
> SSH connection generates another TGS_REQ for krbtgt/REALM@REALM.
> Can anybody explain me this behaviour ? Is it expected ?
It's probably because the client supports ticket forwarding. I suspect
the additional TGS-REQ is to obtain the krbtgt/REALM ticket that will be
forwarded to the remote host.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
