[7818] in Kerberos
Re: destruction of Kerberos credentials upon logout
daemon@ATHENA.MIT.EDU (Ken Hornstein)
Tue Aug 20 15:31:34 1996
To: Sam Hartman <hartmans@MIT.EDU>
Cc: kerberos@MIT.EDU
In-Reply-To: Your message of "20 Aug 1996 13:33:21 EDT."
<tslybjagdum.fsf@tertius.mit.edu>
Date: Tue, 20 Aug 1996 15:10:47 -0400
From: Ken Hornstein <kenh@cmf.nrl.navy.mil>
> Experience has shown that it's much more useful to remove the
>accumulation of unintentionally left Kerberos credentials than to
>preserve credentials for background jobs. Most people who run
>background jobs on a regular basis are able to quickly figure out they
>can copy the ccache and change the environment variable name, or even
>run their jobs under ksu.
I understand that reasoning, and I agree with it; however, we are trying
to make the transition from a non-Kerberos environment to one that uses
Kerberos as much as possible. Anything that helps to ease this transition
would be an asset, and this is one case that will require some retraining.
If the credentials stuck around, it would be a smoother transition.
I just thought this was a useful feature that wouldn't impact sites that
didn't use it, but might help out sites who wanted to move from a
non-Kerberos environment.
> Ken> I'm wondering if there is any interest in making this
> Ken> behavior configurable via krb5.conf - something like
> Ken> "krb5_retain_ccache" under [login]. The default would be to
> Ken> cleanup everything at logout time, but other sites could
> Ken> change this behavior if they wanted to.
>
> Personally, I think this is a bad idea. However, it's an
>issue where I certainly don't have a good feeling about how other
>people stand, so their might be enough support to put it in. I would
>certainly be willing to agree with an AFS-specific option to avoid
>destroying tokens on logout.
Fair enough; what would be a good name for an option such as this?
Something else along these lines - a lot of people here use rsh to
start X applications on other machines with scripts like xrsh or xon;
right now rshd destroys the credential cache when the process exits.
The problem here is that there's really not a good method to copy
the credential cache when running stuff from rsh, and even if we did, it
would be very difficult to modify all of the programs that use rsh to
do the necessary copying (some we do not have source to, such as AVS).
I've got an option like this working now with rshd, and it solves a lot
of problems.
Again, I fully admit that this isn't the best solution, but isn't all of
life a compromise? :-)
--Ken
