[18921] in Kerberos_V5_Development
Re: Negative caching of unknown principals
daemon@ATHENA.MIT.EDU (Benjamin Kaduk)
Sat Aug 2 17:03:27 2014
Date: Sat, 2 Aug 2014 17:03:17 -0400 (EDT)
From: Benjamin Kaduk <kaduk@mit.edu>
To: Simo Sorce <simo@redhat.com>
In-Reply-To: <1406980886.19681.22.camel@willson.usersys.redhat.com>
Message-ID: <alpine.GSO.1.10.1408021701540.21571@multics.mit.edu>
MIME-Version: 1.0
Cc: "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Sat, 2 Aug 2014, Simo Sorce wrote:
> On Fri, 2014-08-01 at 16:46 -0500, Nico Williams wrote:
>> IMO a negative cache belongs in the ccache, with some TTL, and with
>> kvno(1) always (or optionally) ignoring NAKs.
>
> I agree you want to avoid all involved processes in a script to see
> negative caches.
I'm failing to parse this sentence.
> And perhaps add a kdestroy switch that just remove negative entries ?
> This would make it possible for admins to deal with bad negative entries
> during administrative tasks without having to throw away the ccache
> entirely.
This makes it sound like if I stopped after "I agree" in the above
sentence, I would be on the right track.
-Ben
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
