[8377] in Info-AFS_Redistribution
Re: Question about using Kerberos with AFS
daemon@ATHENA.MIT.EDU (Mitch Collinsworth)
Tue Jan 2 17:06:55 2001
Date: Tue, 2 Jan 2001 16:42:25 -0500 (EST)
From: Mitch Collinsworth <mitch@ccmr.cornell.edu>
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Cc: Michael Pelletier <mike@alteon.com>, info-afs@transarc.com
In-Reply-To: <200101022011.f02KBmZ01022@ginger.cmf.nrl.navy.mil>
Message-Id: <Pine.LNX.4.10.10101021639420.10684-100000@ruby.ccmr.cornell.edu>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
On Tue, 2 Jan 2001, Ken Hornstein wrote:
> The _real_ issue comes up with AFS compatibility. You need to salt the
> password with the correct realm name ... and that ends up being tricky.
> Maybe part of this guy's problem was that his AFS cell name didn't
> match his Kerberos realm name, so perhaps I'm overstating the problem.
> But it _does_ make things harder; believe me, I'd try to avoid it
> if at all possible.
Ok, so then what happens when you have to change your DNS name down
the road? If you then change your kerb realm to match, won't that
force a flag day for password changes?
-Mitch
