Re: kcm and pkinit problem

[Love Hörnquist Åstrand <lha@kth.se>]

25 mar 2008 kl. 04.10 skrev Björn Schlögl:

> Hi!
>
> I try to build heimdal 1.1 without pkinit support by using --disable- 
> pk-init,
> but it seems that the patch attached to this mail is necessary to  
> prevent the
> following compilation error from occurring:

Commited your patch, thanks.

> Additionally, I would like to have some information about using kcm  
> to store
> the credentials in. If I set default_cc_name in [libdefaults] in  
> krb5.conf to
> KCM:%{uid}, kinit will fail with:
>
> kinit: krb5_cc_move: kcm_move not implemented

Implemented kcm_move, will write tests later today.

> Some questions:
> Is it recommended to prefer kcm over files in /tmp to store the  
> credentials?
> I personally prefer running servers in chroot and not as root, but  
> none of the
> servers in heimdal support either although none needs root  
> privileges. Would
> you be interested to have such support? In that case I could write  
> patches
> for that.

There is such patch already for the KDC.

https://roundup.it.su.se/jira/browse/HEIMDAL-11

Running the KDC as non root is not itself very intresting for me since  
the root vs non-root question is not every interesting if the non-root  
user can still read the whole kerberos database. The split needs to be  
done inside the KDC too, the part that handles the key data and the  
part that handles the protocol request. Sure, the attacker can get  
hold of the protocol part and issue itself a very long lived ticket,  
but the keys for the users are all still safe.

Love