[7766] in Kerberos
Mundane kerberos question: srvtab management
daemon@ATHENA.MIT.EDU (Doug Engert)
Wed Aug 14 11:53:03 1996
Date: Wed, 14 Aug 1996 10:33:46 -0500
From: Doug Engert <DEEngert@anl.gov>
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Cc: kerberos@MIT.EDU
In-Reply-To: <199608140533.BAA11104@ginger.cmf.nrl.navy.mil>
Ken Hornstein writes:
> And as a site note, how many people _really_ use a floppy/tape drive/whatever
> to send the srvtab to various machines, and how many people just ftp it
> over in the clear? I know that the stuff in the srvtabs should never go
> in the clear, but since you only do it once ...
>
> --Ken
The Kerberos 5 beta 6 kadmin5 man page says that you can "Extract service
key table entry/entries." Since this can be run on the client before
it even has a v5srvtab entry, you should not have to transfer the
v5srvtab entry over the network. The problem with this is that you have
to be the administrator to run it.
I have not tried the above since we are using the DCE security server.
This uses the dcecp or rgy_edit commands to minipulate the v5srvtab
files and the database from the client as well.
There are some differences. Unlike kerberos were you can extract keys
from the database, there is no way to extract a key from the
DCE security server. You can only insert/change keys. This is not as
big a problem as you might think. You can insert a new key into the
database and set the v5srvtab file at the same time. The question then
is who can do this for which principals.
DCE allows you to have ACLs on entries in the security server. This
allows you to have a local administrator be on the ACLs of the host
principals of the machines he maintains. The host principal can
usually update itself as well. This is what the "rgy_edit ktadd -a -r"
command is doing.
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444 <New Area Code 8/3/96>
PGP Key fingerprint = 20 2B 0C 78 43 8A 9C A6 29 F7 A3 6D 5E 30 A6 7F
