[15579] in Kerberos_V5_Development
Re: Creating GSSAPI initiate credential using keytab entry--how
daemon@ATHENA.MIT.EDU (Simo Sorce)
Wed Mar 10 14:46:37 2010
Date: Wed, 10 Mar 2010 14:46:31 -0500
From: Simo Sorce <ssorce@redhat.com>
To: Russ Allbery <rra@stanford.edu>
Message-ID: <20100310144631.69313f54@willson.li.ssimo.org>
In-Reply-To: <87pr3cgeae.fsf@windlord.stanford.edu>
Mime-Version: 1.0
Cc: "krbdev@MIT.EDU" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Wed, 10 Mar 2010 11:36:09 -0800
Russ Allbery <rra@stanford.edu> wrote:
> Nicolas Williams <Nicolas.Williams@sun.com> writes:
>
> > The main issue is: how to find the correct keytab. Using an
> > environment variable will do, but I'd rather have well-known
> > locations for user keytabs, such as:
>
> > /var/run/krb5/keytabs/<user>/keytab
> > /var/krb5/keytabs/<user>/keytab
>
> > The /var/run paths would be nice for system-managed temporary
> > keytabs (think of a PAM module stashing away your keys for
> > subsequent use; I'm not promoting this, but I'd like it to be
> > possible). The /var/krb5 paths would be nice for persistent user
> > keytabs.
>
> I suspect the second path will vary widely between systems. For
> instance, Linux systems following the File Hierarchy Standard would
> not be permitted to use /var/krb5, and I think the most reasonable
> interpretation of the FHS would be that persistent keytabs are
> configuration files and therefore must be in /etc.
/var/lib/krb5 would probably be ok.
I am not so positive keytabs are configuration files though.
They are more like data if you ask me, you could say they are
micro-databases.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
