[24980] in Kerberos
Re: How does enabling any other security protocol affects Kerberos
daemon@ATHENA.MIT.EDU (Chaskiel M Grundman)
Mon Nov 21 12:50:46 2005
From: Chaskiel M Grundman <cg2v@andrew.cmu.edu>
Date: Mon, 21 Nov 2005 12:09:45 -0500
Message-ID: <925FBAD5D1F358CC0B442D8A@[192.168.1.8]>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
--On Monday, November 21, 2005 05:07:49 AM -0800 sandypossible@gmail.com
wrote:
> Hi all,
>
> I am wondering if enabling any other security protocol say such as SSL,
> IPsec or Cipe affects Kerberos functionality?
I'm going to assume that by 'SSL' you mean 'SSL VPN'. (SSL use in
application protocols like http and imap does not affect kerberos
functionality)
activating a VPN tunnel, whether it is based on SSL, IPsec, or CIPE, causes
the IP address of packets you originate to change. If your kerberos tickets
have embedded ip addresses, this may cause them to be unusable if they are
acquired before the tunnel is activated and used after (or vice versa). if
you kinit after the tunnel is activated, this will not be a problem.
You can also set
no-addresses = true
in the [libdefalts] section of your krb5.conf to prevent kinit from
requesting a TGT with embedded addresses.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
