[7838] in Kerberos
Re: destruction of Kerberos credentials upon logout
daemon@ATHENA.MIT.EDU (Sam Hartman)
Thu Aug 22 18:21:46 1996
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Cc: Sam Hartman <hartmans@MIT.EDU>, kerberos@MIT.EDU
From: Sam Hartman <hartmans@MIT.EDU>
Date: 22 Aug 1996 18:08:04 -0400
In-Reply-To: Ken Hornstein's message of Wed, 21 Aug 1996 23:53:12 -0400
>>>>> "Ken" == Ken Hornstein <kenh@cmf.nrl.navy.mil> writes:
>> Agreed. If you happen to get around to writing this, I would
>> certainly be interested in your results. (I'm not implying it
>> is unreasonable to propose ideas if you don't have time to
>> implement them, simply that I too would like to see an
>> implementation. Also, you could set options like default
>> forwarding, default encryption, default renewable lifetime,
>> etc.
Ken> I'm pretty sure I sent in patches that did some of that, at
Ken> least for login :-)
No, your patches effect krb5.conf; I was talking about a
per-user configuration. I agree that defaults should come from
krb5.conf.
Ken> However, this brings up another point -
Ken> I'd like to make an option that will tell various programs to
Ken> forward tickets if possible to the remote system. Does it
Ken> make sense to do something like this:
Ken> [telnet] forward_tgt = 1 [rlogin] forward_tgt = 1
Ken> Or something like:
Ken> [libdefaults] forward_tgt = 1
Ken> Would it really belong in libdefaults? Maybe [defaults], eh?
I would say appdefaults, but yes, this is more reasonable than
having a separate default for each application. Forwarding really
ought to be controlled on a realm-by-realm basis, though. I have very
little control over other realms' DNS and may not wish to trust that
I'm connecting to the host I think I'm connecting to.
Ken> --Ken
