[25213] in Kerberos
RE: Keytab on each client?
daemon@ATHENA.MIT.EDU (Amir Saad)
Thu Jan 5 02:24:54 2006
Content-class: urn:content-classes:message
MIME-Version: 1.0
Date: Thu, 5 Jan 2006 09:19:57 +0200
Message-ID: <6C9EEE1F2D393F4396881A4981A5032548B8A2@SEXGW3K-H2020.local.bibalex.dom>
From: "Amir Saad" <Amir.Saad@bibalex.org>
To: "Paul B. Hill" <pbh@mit.edu>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
thanks for your reply
please consider the following example:
i have two clients , A and B , client B is my LDAP server
now i have created a principal for ldap service , if client A wants to connect LDAP using kerberos
the KDC will send two tickets one of them is encrypted by the LDAP principal key, right?
to decrypt it, the client B (which is the LDAP server) must know its key, how ? i mean client B has no keytab file, how it can decrypt the ticket?
i hope you can help
thanks
Amir Saad
Software Engineer
________________________________
From: Paul B. Hill [mailto:pbh@MIT.EDU]
Sent: Wed 1/4/2006 4:16 PM
To: Amir Saad
Subject: RE: Keytab on each client?
No, you should not copy keytabs to clients.
Think of the keytab as being the application server's password, which it
obtains its own tickets from the KDC. If you use this analogy it helps to
guide you in decisions about how you manage keytabs.
Paul
-----Original Message-----
From: kerberos-bounces@MIT.EDU [mailto:kerberos-bounces@MIT.EDU] On Behalf
Of Amir Saad
Sent: Wednesday, January 04, 2006 8:17 AM
To: kerberos@mit.edu
Subject: Keytab on each client?
i installed kerberos successfully and i tested it using a client machine and
it works fine although i didn't copy the keytab to the client.
the question is, if there is a service running on a client machine for
example LDAP , do i have to copy the server keytab to this client ?
thanks
Amir Saad
Software Engineer
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
