[33740] in Kerberos
Re: hostname for services vs. IP address
daemon@ATHENA.MIT.EDU (Greg Hudson)
Tue Aug 9 10:09:18 2011
From: Greg Hudson <ghudson@mit.edu>
To: Chris Hecker <checker@d6.com>
In-Reply-To: <4E40E823.3010602@d6.com>
Date: Tue, 09 Aug 2011 10:09:12 -0400
Message-ID: <1312898952.2110.46.camel@t410>
Mime-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Tue, 2011-08-09 at 03:56 -0400, Chris Hecker wrote:
> Is service/129.168.1.5 a valid service principal?
Sure. It's not a principal that krb5_sname_to_principal() will
generally return, but if you're creating principal names yourself,
there's nothing invalid about that form.
Of course, you'd have to make sure to key those hosts accordingly. I'm
not sure what to recommend for you since I'm not sure what about the
servers, if anything, you want to authenticate to the client. If the
client doesn't care very much what server it's talking to (as long as
it's within the realm at all) then there aren't a lot of constraints on
what the server principal should be. They just need to be unique so
that hosts can't impersonate clients to each other, and something the
client can figure out or be informed of.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
