[33679] in Kerberos
Re: Changing master key (Kerberos authentication server+LDAP database)
daemon@ATHENA.MIT.EDU (Simo Sorce)
Wed Jul 27 09:55:12 2011
From: Simo Sorce <simo@redhat.com>
To: Anubha Gupta <anuafs84@gmail.com>
In-Reply-To: <ffcbb8d9-edcb-4b8e-b691-30cd746bbf74@h7g2000prf.googlegroups.com>
Date: Wed, 27 Jul 2011 09:36:49 -0400
Message-ID: <1311773809.19717.252.camel@willson.li.ssimo.org>
Mime-Version: 1.0
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Wed, 2011-07-27 at 05:28 -0700, Anubha Gupta wrote:
> Is it possible to change the master key of a realm when LDAP is used
> as the database server? The stash file is not present since LDAP is
> used. Appreciate any help on this.
The standard kldap driver still uses the stash file to hold the master
key as far as I know.
you can use kdb5_dump to dump and change the passwords and load them
back with older releases. In 1.9 it should be possible to change keys
while keeping the database online by storing both the old and the new
master key in the new keytab format stash file.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
