[9058] in athena10
Re: Changing How MIT's VPN & Dial-Up Servers Handle Unauthenticated
daemon@ATHENA.MIT.EDU (Geoffrey Thomas)
Tue May 22 11:16:07 2012
Date: Tue, 22 May 2012 11:16:03 -0400 (EDT)
From: Geoffrey Thomas <geofft@MIT.EDU>
To: Jonathon Weiss <jweiss@MIT.EDU>
cc: Jonathan Reed <jdreed@MIT.EDU>, debathena@MIT.EDU, linerva@MIT.EDU
In-Reply-To: <201205221457.q4MEvEAp012469@outgoing.mit.edu>
Message-ID: <alpine.DEB.2.00.1205221110240.24065@dr-wily.mit.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
[- Andrew and itss, - release-team, + debathena, + linerva]
On Tue, 22 May 2012, Jonathon Weiss wrote:
> I also don't have a hard answer regarding linerva, but Garry and I are
> both of the opnion that it should be treated the same way as the
> dialups, especially since we're still planning to move the name to the
> dialups.
OK, we need to find a way for daemons on Linerva to send authenticated
mail. We might as well do something that's reasonable Debathena-wide;
thoughts (on the technical side) on trying to get tickets with the
default keytab, e.g., something vaguely on the order of
system(qw(klist -s));
+my $have_tickets = $?;
+if ($have_tickets == 0 && $< == 0) {
+ system(qw(kinit -k));
+}
if (($? == 0) &&
(`klist 2>/dev/null` =~ /Default principal: (.*?)\@ATHENA.MIT.EDU/)) {
$kuser = $1;
# Remove any instances
$kuser =~ s|/.*||g;
}
?
(possibly with a non-default ccache and a kdestroy)
I haven't checked if Linerva has any daemons that send mail that don't run
as root.
--
Geoffrey Thomas
geofft@mit.edu
