>I realize that setting up such a thing may not always be easy, but >kerberized cluster services are a very good reason to do it and it can >be done with miniscule changes to MIT krb5. The replay cache currently has no locking, so it's not a miniscule change (okay, it should have locking anyway, no argument there). --Ken