[33559] in Kerberos
Re: Slightly confused by user-to-user authentication...
daemon@ATHENA.MIT.EDU (Greg Hudson)
Thu Jul 7 08:44:56 2011
From: Greg Hudson <ghudson@mit.edu>
To: Chris Hecker <checker@d6.com>
In-Reply-To: <4E154B4D.10504@d6.com>
Date: Thu, 07 Jul 2011 08:44:48 -0400
Message-ID: <1310042688.2694.45.camel@t410>
Mime-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Thu, 2011-07-07 at 01:59 -0400, Chris Hecker wrote:
> One more question about user-to-user: the FAQ says that the "Clocks
> Adrift" paper's solution for not forcing clients to have synced clocks
> is implemented in krb5. How does this relate to user-to-user sessions?
This should work for user-to-user sessions. When a client gets initial
credentials, it learns its clock skew relative to the KDC. (For
processes which come in later, the clock skew is remembered in
file-based ccaches. If you use a different type of ccache, such as a
Linux keyring cache, this mechanism may not work.) So both clients
should be pretending that their time is the KDC's time for the purpose
of Kerberos operations.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
