[18926] in Kerberos_V5_Development
Re: Negative caching of unknown principals
daemon@ATHENA.MIT.EDU (Nico Williams)
Mon Aug 4 13:32:41 2014
Date: Mon, 4 Aug 2014 12:32:33 -0500
From: Nico Williams <nico@cryptonector.com>
To: Greg Hudson <ghudson@mit.edu>
Message-ID: <20140804173232.GO3579@localhost>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <CAK3OfOjz5pRFTMOdYc740Rh3kKFsrd9mzwg-NHO-MHFxuqeMsA@mail.gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>, "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Fri, Aug 01, 2014 at 04:46:27PM -0500, Nico Williams wrote:
> IMO a negative cache belongs in the ccache, with some TTL, and with
> kvno(1) always (or optionally) ignoring NAKs.
It'd be nice if the KDC could advertise a TTL for this.
Also, ideally such ccache entries should be like cc config entries, and
they should have a fixed-sized timestamp that can be overwritten to
immediately expire or refresh it as desired without having to enlarge
the ccache.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
