[8098] in Kerberos
Re: Forwardable tickets question
daemon@ATHENA.MIT.EDU (Barry Jaspan)
Mon Sep 23 13:10:10 1996
Date: Mon, 23 Sep 1996 12:49:04 -0400
From: "Barry Jaspan" <bjaspan@MIT.EDU>
To: Marco S Hyman <marc@dumbcat.codewright.com>
Cc: kerberos@MIT.EDU
In-Reply-To: [8088]
Sep 22 12:31:22 dumbcat krb5kdc[141]: TGS_REQ 204.94.187.130(88):
TGT NOT FORWARDABLE: authtime 843420496, marc@CODEWRIGHT.COM
for krbtgt/CODEWRIGHT.COM@CODEWRIGHT.COM,
KDC can't fulfill requested option
The error message does not say that either marc of krbtgt have the
disable_forwardable bit set; it says the TGT is not forwardable. TGTs
are only forwardable if they are requested to be forwardable by kinit
with the -f option (that request will fail if the disable_forwardable
bit is set on either principal).
This may seem like just another hassle to you, but it provides a
valuable security benefit. If it were not required, anyone could walk
up to your machine when you were not around for even less than a
minute and forward your tickets to another host, then use them until
they expired, without knowing your password. This would be a
dangerous situation to enable by default. If you explicitly set -f,
then presumably you understand the extra bit of risk you are taking
and will behave appropriately.
Barry
