[518] in Kerberos
re: An idea for forwarding access to remote machines
daemon@TELECOM.MIT.EDU (Jerome H. Saltzer)
Fri Oct 21 14:45:26 1988
To: Mark W. Eichin <eichin@ATHENA.MIT.EDU>
Cc: athena-ws@ATHENA.MIT.EDU, kerberos@ATHENA.MIT.EDU
In-Reply-To: Mark W. Eichin <eichin@ATHENA.MIT.EDU>'s message of Fri, 21 Oct 88 07:27:55 EDT
From: Jerome H. Saltzer <Saltzer@ATHENA.MIT.EDU>
> If `proxy mappings' are in some way tied to the authorizing host,
> then the `flush mappings for this host' nfsid request can be extended
> to also `flush mappings authorized by this host' . . .
Mark,
In order for that to work, you need to come up with a bright idea for
automatically deciding when to run nfsid flush and which servers to
send it to. Telling the user to do it by hand misses the interesting
case where someone else authorizes a proxy while I was distracted by
a bull session in the next aisle. (unless the intruder happens to
send proxy authorizations only to servers where you already have an
ordinary mapping.)
Possibly the server should refuse to accept authorization of proxy
mappings unless there is already an ordinary mapping for the
authorizing user. Then, your suggested extension to nfsid/flush
would have the effect that whatever mechanism that user relies on to
flush the ordinary mapping can also be relied on to flush the
proxies. (But you have to think through unmap, too.)
Jerry
