"Richard Basch" writes:
> 2. You can always put system:authuser on the acl.
>
> The second will give you strong protection, because you have verified
> the user's credentials, and you are assuming his password has not been
> compromised (or the security registry). Machine's with srvtabs, if you
> consider them relatively secure can authenticate themselves to the cell
> by getting an afs key with their srvtab identity (from the Kerberos
> server) - after all, a srvtab is basically a machine's password. (All
> you need to do is register the srvtab identity in the ptserver.)
This just isn't true for AFS versions 3.2 and 3.2a from Transarc.
If you put a machine's IP address into your pt server, and then set the
ACL of some directory to system:authuser, anybody using that machine
whether klog'd or not, will be able to access the directory as
system:authuser.
The only way to make sure that someone has klog'd is to set a negative
ACL with all rights on the IP address or a pt group which contains the
IP address and/or wildcard.
< Paul
