[4991] in Kerberos
Re: kinit to another realm failing:, Can't send request
daemon@ATHENA.MIT.EDU (Booker C. Bense)
Tue Apr 18 13:26:52 1995
To: kerberos@MIT.EDU
Date: 18 Apr 1995 09:50:27 -0700
From: bbense@spelljammer.stanford.edu (Booker C. Bense)
In article <3mts4u$elg@spelljammer.stanford.edu>,
Booker C. Bense <bbense@spelljammer.stanford.edu> wrote:
>In article <3msin7$giu@nova.voicenet.com>,
>Bruce Momjian <root@candle.pha.pa.us> wrote:
>>I am trying to use kinit to get a ticket (login) to a non-local realm.
>>In fact, the realm is not part of the local domain, and is not contained
>>in the kerberos krb.conf file.
>>
>[problem deleted ]
>>
>>Does the system administrator have to put every realm in the krb.conf
>>file to make it reachable via kinit?
>
>- No, you have to put them in krb.realms.......... %-( !!
>
- Arggh... Never post before coffee... I am wrong here. krb.conf
is file in which you specify kerberos servers for a given realm.
krb.realms is the file which determines which realm a given
dns name is associated with. So in order to kinit in a you need
to have the kerberos servers in krb.conf. In order to use any
kerberized applications you will need to have the remote realm
defined in krb.realms unless their DNS domain name exactly
matches their kerberos realm name. Nothing requires this, but
most kerberos sites are set up that way...
>> Is there a way for a user to
>>over-ride the krb.conf file without having to bother the administrator?
>>
>
>- If you are using Cygnus kerberos software, it attempts to guess the kerberos
>server from the domain name. ( A potentially unsecure misfeature
> IMHO ).
- Given the current state of paranoia on this list, my choice of
the word insecure is inappropriate. It's an overstatement. In
general, whenever I see "magic" strings imbedded in the software,
my security bells go off and I start thinking about ways to
crack... I still think it's a misfeature, but it is not in any
way less secure than any other kerberos 4 software.
> You can
>also override the system defaults using the environment variable KRB_CONF.
>
>% setenv KRB_CONF ~/my_krb.conf
>% kinit
>
- In general, I think Cyngus is doing great work. I have been
happily using their stuff for the last two years, both as just a
general net geek and a paying customer ( in my former job). I
recommend them highly.
- Booker C. Bense : bbense@networking.stanford.edu
