European AFS Kerberos Conference 2010 - essential info update

2010-09-03 Thread Luboš Kejzlar
Hi all, Last week remain to the beginning of European AFS Kerberos Conference. This is an essential information update for everyone who still hesitate to register for upcoming event. The organization team proudly announce following great conference news: - Early registration rates

Multi Realm Question

2010-09-03 Thread Tom Parker
Hi I have an odd situation and I am wondering if anyone on the list has done this before or has any suggestions. I am setting up an international network of servers in various countries that will have local staff authenticating against a local realm (XX.EXAMPLE.COM) for daily activities. I

Kerberos and 2038 date rollover in effect - how to fix?

2010-09-03 Thread Tucks
Hello. I've had a hilariously fun day so far, so I need to pick your brains so to speak. When our Kerberos V5 system was setup on FC 8, for reasons quite unknown, the ticket maxlife was set to 1 days. Sometime early this morning (today + 1 days) = 2038 bug date and the kerberos ticket

Re: Multi Realm Question

2010-09-03 Thread Greg Hudson
On Fri, 2010-09-03 at 15:36 -0400, Tom Parker wrote: My question therefor is: Is there a way to run a single KDC with two realms, One as master for XX.EXAMPLE.COM and one as slave for EXAMPLE.COM? And if not, how would you solve this? It is possible for a single MIT krb5 KDC process to

Re: Multi Realm Question

2010-09-03 Thread Tom Parker
On 09/03/2010 04:40 PM, Greg Hudson wrote: On Fri, 2010-09-03 at 15:36 -0400, Tom Parker wrote: My question therefor is: Is there a way to run a single KDC with two realms, One as master for XX.EXAMPLE.COM and one as slave for EXAMPLE.COM? And if not, how would you solve this? It is

Re: Kerberos and 2038 date rollover in effect - how to fix?

2010-09-03 Thread Greg Hudson
On Fri, 2010-09-03 at 13:00 -0400, Tucks wrote: Does anyone have any idea how to force through the new ticket expiry change? According to all the documentation I've read, it should be good, but isn't. I've probably missed something trivial. No propagation should be necessary between the

Re: Multi Realm Question

2010-09-03 Thread Stephen Frost
* Tom Parker (tpar...@cbnco.com) wrote: I am trying to avoid the need for a 3rd authentication server at my remote sites (XX.EXAMPLE.COM master and slave + EXAMPLE.COM slave) Have you considered just running multiple kdc processes..? I'd think you could do more than one on a single box, but