[519] in Kerberos
An idea for forwarding access to remote machines
daemon@TELECOM.MIT.EDU (probe@ATHENA.MIT.EDU)
Fri Oct 21 15:36:02 1988
From: probe@ATHENA.MIT.EDU
To: Saltzer@ATHENA.MIT.EDU
Cc: eichin@ATHENA.MIT.EDU, athena-ws@ATHENA.MIT.EDU, kerberos@ATHENA.MIT.EDU
In-Reply-To: Jerome H. Saltzer's message of Fri, 21 Oct 88 14:33:53 EDT <8810211833.AA04474@HERACLES.MIT.EDU>
Reply-To: Richard Basch <probe@ATHENA.MIT.EDU>
> Date: Fri, 21 Oct 88 14:33:53 EDT
> From: Jerome H. Saltzer <Saltzer@ATHENA.MIT.EDU>
> Sender: Saltzer@ATHENA.MIT.EDU
> Repository: heracles
> Originating-Client: E40-391A-1
> > If `proxy mappings' are in some way tied to the authorizing host,
> > then the `flush mappings for this host' nfsid request can be extended
> > to also `flush mappings authorized by this host' . . .
> Mark,
> In order for that to work, you need to come up with a bright idea for
> automatically deciding when to run nfsid flush and which servers to
> send it to. Telling the user to do it by hand misses the interesting
> case where someone else authorizes a proxy while I was distracted by
> a bull session in the next aisle. (unless the intruder happens to
> send proxy authorizations only to servers where you already have an
> ordinary mapping.)
> Possibly the server should refuse to accept authorization of proxy
> mappings unless there is already an ordinary mapping for the
> authorizing user. Then, your suggested extension to nfsid/flush
> would have the effect that whatever mechanism that user relies on to
> flush the ordinary mapping can also be relied on to flush the
> proxies. (But you have to think through unmap, too.)
There is an option to nfsid that will flush all of a user's mappings to
a given host (nfsid -r host). Unfortunately, becuase the KUIDUPURGE
code is broken in the current release of rpc.mountd, this does not work
as expected (actually, the KUIDUPURGE code was missing). "Fixed in the
next release".
-Richard
