Accessing Kerberos NFS version 4 (not 2, 3) via /net automounter with kinit only (no /etc/krb5.conf access)
Nico Williams
nico at cryptonector.com
Tue Apr 15 18:10:24 EDT 2014
On Tue, Apr 15, 2014 at 4:48 PM, Will Fiveash <will.fiveash at oracle.com> wrote:
> On Tue, Apr 15, 2014 at 02:34:11PM -0500, Nico Williams wrote:
>> What should happen is that there should be a way to enroll a device.
>
> If a keytab is really needed. On the otherhand, if a laptop is only
> acting as a client then why bother? Assuming the logged-in user has a
> way of acquiring their krb cred that's all they should need if the
> laptop is acting as a NFS, ssh or any other client that tries to do
> gss/krb auth.
Sure, that's a fair thing to do in the short-term. In the long term I
suspect you'll have many reasons to want to enroll a device (e.g., to
do FAST w/o PKINIT).
And in order to make this short-term fix workable you need a way to
configure the system to make the user's Kerberos credential also be
the system's (root's).
More information about the Kerberos
mailing list