[327] in Kerberos_V5_Development
rkinit in version 5
qjb@ATHENA.MIT.EDU (qjb@ATHENA.MIT.EDU)
Sun Oct 14 12:40:14 1990
At some point, I suppose someone will have to think about
implementing an rkinit for version 5. This version will be able
to take advantage of user to user, proxiable, forwardable, etc.
tickets so that it will be a generally much more useful program.
My knowledge of how krb5 is actually going has gotten
sufficiently out of date that I don't know how much of this will
be trivial (i.e., is already handled by the library).
Anyway, I want to make a few comments concerning the v4 version.
I was young and naive when I designed that library. I think I
got the protocol write, but the other aspects wrong. The
protocol itself allowed the entire exchange to happen in a
way so that the password existed on the client for a
computationally-bound amount of time (i.e, network problems,
disk problems, etc. couldn't affect this). Also, the library
did error handling reasonably well so that timeouts, errors in
library functions or system calls, etc. would just have rkinit()
return with an error leaving all file descriptors closed and all
signal handlers restored to their original values. (Granted, a
setjmp was needed for this, but you can't have everything.)
There was one major thing that it did wrong, however, and this
was important enough to cause rkinit's usefulness to be little
more than it would have been if it hadn't been implemented in a
library. rkinit() *always* talks to rkinitd which is started
from inetd on a known port (rkinit/tcp). The rkinit() call
*should have* taken something like a socket and sockaddr_in
instead of (or perhaps in addition to, but perhaps not) a host
name. The library should have also included the server side of
the functionality. This way, an arbitrary client and server
could say, "Okay. Now let's do an rkinit over this socket."
Unfortunately, I am not volunteering to implement this since I
will probably never have enough full-time work time to do it
between now and when I leave MIT (or when kerberos does,
whichever comes first). Besides, I have to finish my current
project first.... Oh well.
