On Fri, Sep 17, 2010 at 10:40:19AM -0700, egrama wrote: > Shouldn't a non-forwardable ticket be good only on the host to which > it was issued to (host A in our example)?
Because of NAT the use of addresses to control where a ticket can be used from has become difficult at best to keep going, thus many sites use address-less tickets, which in turn can be "forwarded" anywhere you want. The solution to this should be to require that a ticket be used in conjunction with another ticket for a client host principal corresponding to the host that the ticket is tied down to. This would have to be done via authorization-data elements in the Authenticator. Nico -- ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
