[15578] in Kerberos_V5_Development
Re: Creating GSSAPI initiate credential using keytab
daemon@ATHENA.MIT.EDU (Russ Allbery)
Wed Mar 10 14:36:12 2010
From: Russ Allbery <rra@stanford.edu>
To: "krbdev\@MIT.EDU" <krbdev@mit.edu>
In-Reply-To: <20100310191432.GO24640@Sun.COM> (Nicolas Williams's message of
"Wed, 10 Mar 2010 13:14:32 -0600")
Date: Wed, 10 Mar 2010 11:36:09 -0800
Message-ID: <87pr3cgeae.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Nicolas Williams <Nicolas.Williams@sun.com> writes:
> The main issue is: how to find the correct keytab. Using an environment
> variable will do, but I'd rather have well-known locations for user
> keytabs, such as:
> /var/run/krb5/keytabs/<user>/keytab
> /var/krb5/keytabs/<user>/keytab
> The /var/run paths would be nice for system-managed temporary keytabs
> (think of a PAM module stashing away your keys for subsequent use; I'm
> not promoting this, but I'd like it to be possible). The /var/krb5
> paths would be nice for persistent user keytabs.
I suspect the second path will vary widely between systems. For instance,
Linux systems following the File Hierarchy Standard would not be permitted
to use /var/krb5, and I think the most reasonable interpretation of the
FHS would be that persistent keytabs are configuration files and therefore
must be in /etc.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
