[7827] in Kerberos
Re: destruction of Kerberos credentials upon logout
daemon@ATHENA.MIT.EDU (Sam Hartman)
Wed Aug 21 19:34:21 1996
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Cc: Sam Hartman <hartmans@MIT.EDU>, kerberos@MIT.EDU
From: Sam Hartman <hartmans@MIT.EDU>
Date: 21 Aug 1996 19:22:27 -0400
In-Reply-To: Ken Hornstein's message of Wed, 21 Aug 1996 16:43:30 -0400
>>>>> "Ken" == Ken Hornstein <kenh@cmf.nrl.navy.mil> writes:
Ken> I agree; it's too bad there isn't a way to tie tickets into
Ken> the proc structure in the kernel, since you could track
Ken> process references really easily that way (I suppose it's
Ken> possible for some Unixes, but certainly not an option for all
Ken> of them).
There are ways of approximating this. There is the hack you
describe below, and there is also the hack SSH uses. Basically, you
have the daemon that opens the connection maintain a file descriptor
to the cache, and pass it down from parent to child. I think Ssh
actually has the daemon respond to key management requests over a
socket, but in the case of Kerberos, you might have a fd pointing to
an unlinked file. Of course, there is the annoying problem that some
shells tend to close all file descriptors, but no hack is perfect.
