Projects/What does God need with a password - Revision history

TomYu at 20:19, 22 December 2010

2010-12-22T20:19:45Z

TomYu at 19:42, 18 October 2010

2010-10-18T19:42:06Z

SamHartman: review

2010-09-14T16:53:30Z

review

SamHartman: kinit -C

2010-09-13T20:50:56Z

kinit -C

New page

{{project-early}}
''kinit -C'' with apologies to [http://www.imdb.com/title/tt0098382/quotes Star Trek].

The administrator of a Kerberos database has access to all user keys within that database. This is sufficient to impersonate any user. Today, no convenient user interface is provided for logging in as a given user without changing that user's passowrd.
This project proposes to add a ''-c'' (cheat) option to kinit. If this option is supplied, then the key will be extracted from the database rather than prompting for a password. This option requires that kinit be run on a KDC with read access to the Kerberos database and stash file.

== Implementation ==

Kinit will register and use the kdb keytab in order to access the database. It will actually contact the KDC process and go through th efull AS-REQ path. The advantage of this is that any authorization data is generated. The disadvantage is that users who require pkinit or hardware preauth cannot be logged in using this mechanism. As a result, kinit will link against libkdb5 and libkadm5srv.

@@ Line 2: / Line 2: @@
 ''kinit -C'' with apologies to [http://www.imdb.com/title/tt0098382/quotes Star Trek].
-The administrator of a Kerberos database has access to all user keys within that database. This is sufficient to impersonate any user. Today, no convenient user interface is provided for logging in as a given user without changing that user's passowrd.
+The administrator of a Kerberos database has access to all user keys within that database. This is sufficient to impersonate any user. Today, no convenient user interface is provided for logging in as a given user without changing that user's password.
-This project proposes to add a ''-c'' (cheat) option to kinit. If this option is supplied, then the key will be extracted from the database rather than prompting for a password. This option requires that kinit be run on a KDC with read access to the Kerberos database and stash file.
+This project proposes to add a ''-C'' (cheat) option to kinit. If this option is supplied, then the key will be extracted from the database rather than prompting for a password. This option requires that kinit be run on a KDC with read access to the Kerberos database and stash file.
 == Implementation ==
@@ Line 25: / Line 25: @@
 ===Discussion===
-Discussion on the krbdev mailing list focused on concerns that packagers would have to do the somewhat surprising thing of bundling the KDC libraries with the client libraries in order to make kinit function.  No one could identify a significant practical problem.  In the future, a plugin capability for keytabs should make this moot.
+Discussion on the krbdev mailing list focused on concerns that packagers would have to take the somewhat surprising action of bundling the KDC libraries with the client libraries in order to make kinit function.  No one could identify a significant practical problem, and some packagers already bundle the KDC libraries with the client libraries.  In the future, a plugin capability for keytabs should make this moot.

@@ Line 1: / Line 1: @@
-{{project-review|2010-09-24}}
+{{project-rel|1.9}}
 ''kinit -C'' with apologies to [http://www.imdb.com/title/tt0098382/quotes Star Trek].
@@ Line 8: / Line 8: @@
 == Implementation ==
-Kinit will register and use the kdb keytab  in order to access the database. It will actually contact the KDC process and go through th efull AS-REQ path. The advantage of this is that any authorization data is generated. The disadvantage is that users who require pkinit or hardware preauth cannot be logged in using this mechanism. As a result, kinit will link against libkdb5 and libkadm5srv.
+Kinit will register and use the kdb keytab in order to access the database. It will actually contact the KDC process and go through the full AS-REQ path. The advantage of this is that any authorization data is generated. The disadvantage is that users who require pkinit or hardware preauth cannot be logged in using this mechanism. As a result, kinit will link against libkdb5 and libkadm5srv.
 ==Review==
@@ Line 19: / Line 19: @@
 ===Approvals===
 ===Discussion===