Re: Thoughts on long-lived credentials

2006-01-23 Thread Phil Pishioneri
On 2006/1/19 3:06 PM, Luke Howard wrote: Windows does this I think. In fact I seem to recall that for at least some versions of Windows it doesn't even bother trying to renew the tickets and just always uses the stored key. Unfortunately I never leave my Windows workstation unlocked

Re: Thoughts on long-lived credentials

2006-01-22 Thread Russ Allbery
Luke Howard [EMAIL PROTECTED] writes: What are the current thoughts on automatically renewing Kerberos credentials for long-lived sessions, particularly with respect to NFSv4 (where the user experience could be adversely affected)? It seems that Solaris has kwarnd, which can both warn users

Re: Thoughts on long-lived credentials

2006-01-20 Thread Fredrik Tolf
On Sat, 2006-01-21 at 02:16 +0100, Fredrik Tolf wrote: I'll attach the files (they are rather small anyway) if you want them. It seems the files didn't get attached. Does this mailing list filter attachments? In any event, I have also written another small program for automatic ticket renewal,

Thoughts on long-lived credentials

2006-01-19 Thread Luke Howard
What are the current thoughts on automatically renewing Kerberos credentials for long-lived sessions, particularly with respect to NFSv4 (where the user experience could be adversely affected)? It seems that Solaris has kwarnd, which can both warn users of impending ticket expiry as well as

Re: Thoughts on long-lived credentials

2006-01-19 Thread Douglas E. Engert
Luke Howard wrote: Another issue is what to do when a TGT is no longer renewable. At first, we thought one might wish to store one's long-term Kerberos key at logon, so it would be possible to reacquire a TGT after the renewable lifetime was up. (*) If using PKINIT or if the ticket cache

Re: Thoughts on long-lived credentials

2006-01-19 Thread Kevin Coffman
On 1/19/06, Luke Howard [EMAIL PROTECTED] wrote: What are the current thoughts on automatically renewing Kerberos credentials for long-lived sessions, particularly with respect to NFSv4 (where the user experience could be adversely affected)? It seems that Solaris has kwarnd, which can both

Re: Thoughts on long-lived credentials

2006-01-19 Thread Alexandra Ellwood
On Jan 19, 2006, at 11:59 AM, Luke Howard wrote: What are the current thoughts on automatically renewing Kerberos credentials for long-lived sessions, particularly with respect to NFSv4 (where the user experience could be adversely affected)? Kerberos.app on Mac OS X has auto-renewed

Re: Thoughts on long-lived credentials

2006-01-19 Thread Luke Howard
1) Auto-renewal mechanism tied to a specific ccache type won't work for other types of caches. Right, we made this mistake with KCM. Oh well! Windows does this I think. In fact I seem to recall that for at least some versions of Windows it doesn't even bother trying to renew the tickets

Re: Thoughts on long-lived credentials

2006-01-19 Thread Nicolas Williams
On Fri, Jan 20, 2006 at 07:06:00AM +1100, Luke Howard wrote: Windows does this I think. In fact I seem to recall that for at least some versions of Windows it doesn't even bother trying to renew the tickets and just always uses the stored key. Unfortunately I never leave my Windows