[15581] in Kerberos_V5_Development
Re: Creating GSSAPI initiate credential using keytab entry--how
daemon@ATHENA.MIT.EDU (Russ Allbery)
Wed Mar 10 15:01:43 2010
From: Russ Allbery <rra@stanford.edu>
To: "krbdev\@MIT.EDU" <krbdev@mit.edu>
In-Reply-To: <20100310144631.69313f54@willson.li.ssimo.org> (Simo Sorce's
message of "Wed, 10 Mar 2010 14:46:31 -0500")
Date: Wed, 10 Mar 2010 12:01:40 -0800
Message-ID: <87lje0gd3v.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Simo Sorce <ssorce@redhat.com> writes:
> Russ Allbery <rra@stanford.edu> wrote:
>> I suspect the second path will vary widely between systems. For
>> instance, Linux systems following the File Hierarchy Standard would not
>> be permitted to use /var/krb5, and I think the most reasonable
>> interpretation of the FHS would be that persistent keytabs are
>> configuration files and therefore must be in /etc.
> /var/lib/krb5 would probably be ok.
Yes, if you don't think keytabs are configuration files.
> I am not so positive keytabs are configuration files though. They are
> more like data if you ask me, you could say they are micro-databases.
Authorization material has always been treated as a configuration file on
Linux systems, IMO. Configured database passwords, usernames, and similar
sorts of legacy credentials are fairly uniformly in configuration files in
/etc. Likewise for system X.509 certificates and, for Debian at least,
the PGP keys used to verify package downloads (and, for that matter,
/etc/shadow). Most tellingly, the system keytab is always a configuration
file in /etc and has been for many years.
With my Debian Policy hat on, I'd object to a default location in /var for
persistent keytabs. /etc/keytabs or (probably better) /etc/krb5/keytabs
would be my recommendation, with a legacy exception for /etc/krb5.keytab.
All that aside, though, I really like Nico's original point. I think
having a default location and naming convention for keytabs would be very
useful and would solve a lot of annoying problems.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
