[7824] in Kerberos
Re: destruction of Kerberos credentials upon logout
daemon@ATHENA.MIT.EDU (Ken Hornstein)
Wed Aug 21 17:01:44 1996
To: Sam Hartman <hartmans@MIT.EDU>
Cc: kerberos@MIT.EDU
In-Reply-To: Your message of "21 Aug 1996 14:44:56 EDT."
<tslu3twa85z.fsf@tertius.mit.edu>
Date: Wed, 21 Aug 1996 16:43:30 -0400
From: Ken Hornstein <kenh@cmf.nrl.navy.mil>
>destroy credentials. I just think that it might create more of a
>problem than it's worth to make it easy for admins to choose not to
>destroy credentials.
>
>I talked to a few people I know who have experience dealing with user
>support and to another Kerberos developer. They all agreed that in
>many environments, the option would tend to get turned on without a
>full understanding of the consequences, and would tend not to get
>turned off.
I understand, and I admit that I don't have a good answer either.
However, the more I think about it, I think that for login, not destroying
the AFS credentials will be good enough for 90% of our users.
> The problem here is that it's even more inconvenient to
>destroy credentials than to copy them when you're using RSH. I agree
>that neither is particularly convenient. I would like to think more
>about this problem and try to come up with a solution, although I know
>from personal experience that simply not destroying the credentials
>tends to be the wrong solution. It creates a large mess in /tmp, and
>leaves many live credentials around that users never clean up. I
>would agree that an afs_retain_tokens option would be reasonable
>if/when someone adds code to destroy the tokens to your aklog patch.
>However, I would like to find a more general solution to the problem.
I agree; it's too bad there isn't a way to tie tickets into the proc
structure in the kernel, since you could track process references really
easily that way (I suppose it's possible for some Unixes, but certainly
not an option for all of them).
I wonder if a cron job that periodically scrubs old credential caches out
of /tmp might solve at least one problem (but doesn't solve the problem
about what to do with live credentials). But since you can find out a
processes environment with ps, you could scan through all of the processes
and see if there exists a process that is using that value for KRB5CCNAME,
and if there were no processes using that, then delete the credential cache.
Boy, that would be ugly, wouldn't it? :-)
> Are most of the jobs that are started explicitly backgrounded
>or do they background themselves?
The script in question (xon, included with R6) explicitly backgrounds them;
I believe that xrsh does the same.
--Ken
