Difference between revisions of "Release Meeting Minutes/2014-06-17"
From K5Wiki
(New page: {{minutes|2014}} Tony Acero, Viktor Dukhovni, Will Fiveash, Greg Hudson, Zhanna Tsitkov, Nico Williams, Tom Yu ;Tom: Will, have you seen any DB2 corruption since we fixed the last big bug...) |
(No difference)
|
Latest revision as of 16:18, 17 June 2014
Tony Acero, Viktor Dukhovni, Will Fiveash, Greg Hudson, Zhanna Tsitkov, Nico Williams, Tom Yu
- Tom
- Will, have you seen any DB2 corruption since we fixed the last big bug?
- Will
- Haven't asked people yet; will make a note.
- Greg
- Nico, Russ wants to know your preferred JSON lib.
- Nico
- libjq https://github.com/stedolan/jq
- Nico
- Have some changes to Heimdal (not pushed) to do capaths computation. Wanted to call jq from Heimdal, ran into problems with heimbase.
Firewalled realms
- Viktor
- Various scenarios where users ssh into DMZ machines -- DMZ has no connectivity to origin realm. Get and delegate krbtgt/target@target. Keeps origin creds from leaking into possibly less secure target realm.
- Viktor
- Selected realms get destination TGTs instead of origin TGTs forwarded; alternatively, white list realms that get origin TGTs.
- Tom
- Two pieces
- list of target realms to which to forward local target TGTs
- client lib on destination app server -- deal with the weird ccache
We think identifying the "starting TGT" in a ccache for this situation (client origin realm different from krbtgt/A@A) is helpful, probably using a ccache config entry.
- Viktor
- Java bug -- sometimes picks wrong krbtgt/A@A if there are multiple in cache.
- Tom
- Does hopping realms work? e.g. client@A ssh to DMZ realm B, then ssh to different DMZ realm C that can't talk to B?
- Viktor
- Should work.
- Greg
- Receive side might be better to implement first.
- Tom
- Need to coordinate how to structure the configuration settings.
DB2
- Will
- Sent mail re DB2 -- probably haven't seen that kind of corruption since that bug [krbdev.mit.edu #5880] was fixed.
