[16347] in Kerberos_V5_Development
Re: Removing old keys
daemon@ATHENA.MIT.EDU (Russ Allbery)
Mon Sep 20 16:18:26 2010
From: Russ Allbery <rra@stanford.edu>
To: Tom Yu <tlyu@mit.edu>
In-Reply-To: <ldvsk14maz1.fsf@cathode-dark-space.mit.edu> (Tom Yu's message of
"Mon, 20 Sep 2010 16:11:30 -0400")
Date: Mon, 20 Sep 2010 13:18:15 -0700
Message-ID: <87tylkgoe0.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: "krbdev@mit.edu" <krbdev@mit.edu>, Jonathan Reams <jr3074@columbia.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Tom Yu <tlyu@MIT.EDU> writes:
> What would people prefer in terms of an interface for this capability?
> * delete all old kvnos
> * delete one specific kvno
> * something else
> We would probably implement this as a new kadmin RPC.
The same semantics offered for keytabs by Heimdal ktutil look right to me,
namely all of:
* Remove a specified kvno.
* Purge all old kvnos.
* Purge all old kvnos which are at least as old as an <age> argument.
The last two could of course use a single RPC.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
