On Tue, 2009-08-11 at 14:03 -0700, Russ Allbery wrote: > Edward Murrell <[email protected]> writes: > > > I've been wondering about this problem for a while. My current solution > > on my laptop is to use a normal /etc/passwd login, and run kinit once > > I'm logged in. > > > > What I would like is to allow some method of transparently caching > > passwords, then creating a TGT once network connectivity if established. > > This wouldn't be as neat, and I don't want to discourage you from pursuing > the neat solution, but have you considered just stacking pam_unix and > pam_krb5, setting your local password to match your Kerberos password, and > then attempting pam_krb5 first and falling back on pam_unix if pam_krb5 > fails? > > It does have the drawback of opening your Kerberos password up to an > off-line brute force attack by someone who steals your laptop and hence > has access to the local /etc/shadow file, but that doesn't seem like too > huge of a security drawback to me. >
Yep. The problem is that I don't get network (wifi) connectivity till after I'm logged in. I guess there's some argument as to weather this is good or bad design, but that's how it is. ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
