Update to the design of the Master Key Migration project
Nicolas.Williams at sun.com
Thu Sep 25 14:57:37 EDT 2008
On Thu, Sep 25, 2008 at 02:41:58PM -0400, Ken Hornstein wrote:
> >Everything that's highlighted is new: 'randkey' and 'delkeys'
> >sub-commands, kvnos in use output line, and modprinc '-use_kvno' option.
> >Yes, I realize that 'delkeys' would require a protocol change, so phat
> >chance of that. I can live without 'delkeys'. (Or can the randkey RPCs
> >be twisted to do a don't-add-keys-just-delete-old-keys RPC? Do we even
> You know, from a practical perspective, "delkeys" would be helpful.
> Not only would be useful in this case, but I would _love_ the ability
> to delete a particular key (based on the enctype) from a principal.
> Sample situation - I generate a new host key based on our default enctypes.
> I put that on a host, and I discover that I screwed up and put a key
> in the keytab that the host's Kerberos implementation cannot support.
> It would be wonderful if could delete that key (or otherwise make it
> so the KDC would never issue a service ticket for it) without having
> to rekey that host.
Agreed. I suppose RPCs can always just be added, so, perhaps delkeys
wouldn't be hard. Will thinks delkeys is outside the scope of this
More information about the krbdev