[7795] in Kerberos
Re: Mundane kerberos question: srvtab management
daemon@ATHENA.MIT.EDU (Phi H Truong)
Fri Aug 16 11:09:19 1996
To: kerberos@MIT.EDU
Date: 16 Aug 1996 14:25:43 GMT
From: orion@iastate.edu (Phi H Truong)
Reply-To: orion@iastate.edu (Phi H Truong)
In article <tsl4tm47049.fsf@tertius.mit.edu>,
Sam Hartman <hartmans@MIT.EDU> wrote:
> How did you securely transport the srvtab from the Kerberos
>server to the machine?
We don't, securely that is. Lets look at the problem from a different
perspective - professor, researcher, grad students, ... etc. Most of them
have very little knowledge on sysadmin, security and encryption stuff; and
they could careless about those things. They just want machines that they
can run their stuff for research and what not. They will scream at anything
that inconvenient their works (we all know that researchers with big grants
scream the loudest). Most of us realized by now that security is inversely
proportional to convenient. Whether you transport the srvtab in form of
disk, tape, pgp-encrypted-AFS-droping, ssh, ...etc is very inconvenient to
these people. This is a social problem which we are trying to solve by
using technical solution.
We just said "the hell with transport srvtab securely." We got a client
program on the machine which during boot up sequence goes out and asks the
srvtab server for its srvtab. The srvtab server goes through the usual IP,
ethernet, name checking then the server sends the srvtab to the client. We
don't backup root partition since we can wipe the machine clean and rebuild
within 15-20 min (which also depends on the network status at that time).
However, we added another service to athena-ism, authorization service (AS).
AS allowed the owner of the machine to control who can access, become root,
use the local printer. The idea of controlling who can use which resources
sell much better with these folks since they don't want some undergrad
performing raytracing on their alpha servers while they are doing gazillion
points quantum energy level analysis.
--
_____
Phi H. Truong "No wisdom. No enlightenment. Only you."
orion@iastate.edu ISU Computation Center
Systems Analyst 237 Durham Center ph: (515) 294 -1420
<a href="http://www.public.iastate.edu/~orion/">Phi Truong</a>
