[18920] in Kerberos_V5_Development
Re: Negative caching of unknown principals
daemon@ATHENA.MIT.EDU (Simo Sorce)
Sat Aug 2 08:02:22 2014
Message-ID: <1406980886.19681.22.camel@willson.usersys.redhat.com>
From: Simo Sorce <simo@redhat.com>
To: Nico Williams <nico@cryptonector.com>
Date: Sat, 02 Aug 2014 08:01:26 -0400
In-Reply-To: <CAK3OfOjz5pRFTMOdYc740Rh3kKFsrd9mzwg-NHO-MHFxuqeMsA@mail.gmail.com>
Mime-Version: 1.0
Cc: David Woodhouse <dwmw2@infradead.org>, "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Fri, 2014-08-01 at 16:46 -0500, Nico Williams wrote:
> IMO a negative cache belongs in the ccache, with some TTL, and with
> kvno(1) always (or optionally) ignoring NAKs.
I agree you want to avoid all involved processes in a script to see
negative caches.
And perhaps add a kdestroy switch that just remove negative entries ?
This would make it possible for admins to deal with bad negative entries
during administrative tasks without having to throw away the ccache
entirely.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
