[38288] in Kerberos
Any set of flags on a princ to allow an AS but no TGS request?
daemon@ATHENA.MIT.EDU (Chris Hecker)
Thu Aug 2 00:53:02 2018
To: "kerberos@mit.edu" <kerberos@mit.edu>
From: Chris Hecker <checker@d6.com>
Message-ID: <0491303d-ed97-341f-cdff-41534ef8710e@d6.com>
Date: Wed, 1 Aug 2018 21:52:46 -0700
MIME-Version: 1.0
Content-Language: en-US
Content-Type: text/plain; charset="utf-8"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
I'd like to make a princ that can be used to test whether the kdc is
working for login, but I don't want this princ to be able to get tickets
to any services (except the initial TGT). I can turn off u2u with dup
skey, and I tried setting the -maxlife to 0 but that defaulted to 24
hours, and even setting -maxlife "1 second" still lets kvno get tickets
for a while (I assume for the clock skew window, though the tickets have
a start time after their expires time, so maybe they're not usable, I
haven't tried using them). Am I missing something obvious?
Chris
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
