[33649] in Kerberos
Re: how to "ban" clients?
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Jul 25 11:37:29 2011
From: Greg Hudson <ghudson@mit.edu>
To: Nico Williams <nico@cryptonector.com>
In-Reply-To: <CAK3OfOioYT_ApwMQkyGjF9+mci-+eRqkHCLZgb__DVzuDBTmXg@mail.gmail.com>
Date: Mon, 25 Jul 2011 11:37:22 -0400
Message-ID: <1311608242.23877.226.camel@t410>
Mime-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Sun, 2011-07-24 at 17:30 -0400, Nico Williams wrote:
> For performance reasons? It's like this forever, so there may not be
> a performance reason anymore. IMO this should be fixed.
I think performance is still an issue. We definitely still get feedback
about the number of LDAP queries per KDC operation, and TGS requests are
more frequent than AS requests. (At least, they should be. It depends
on how often the KDC is used purely as a password verifier.)
We could add a configuration knob, but I'm still trying to justify the
increased complexity to myself. Preventing a disabled account from
making new TGS requests with a valid TGT seems like closing the barn
door after the horse has escaped, as you have no control over the
service tickets the client already obtained before it was disabled.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
