Master key migration and the stash command
rra at stanford.edu
Wed Jan 28 14:10:50 EST 2009
ghudson at MIT.EDU writes:
> Currently, "kdb5_util stash" does the following:
> 1. Open the database (or fail out)
> 2. (If there is an existing stash file, read in the master key and
> forget about it; this is odd but unimportant)
> 3. Prompt for the master key
> 4. Verify the entered key against the database (or fail out)
> 5. Write out the stash file
> There are two issues here. First, you can't stash the password before
> creating the database, which complicates the setup of slave DBs.
> Second, part of the master key migration project plan requires a "sync
> the stash" operation to update the stash file with all master keys.
RT #6345 is related and would probably be fixed by the same measures.
Russ Allbery (rra at stanford.edu) <http://www.eyrie.org/~eagle/>
More information about the krbdev