On 06/18/2010 06:03 PM, Simo Sorce wrote:
On Fri, 18 Jun 2010 16:18:05 +0400
Eugene Indenbom<eindenbom(a)gmail.com> wrote:
> I hope that 389-ds team would support dropping expired GSSAPI
> connection BEFORE changes to MIT Kerberos implementation become
> widely available. Otherwise it will create a substantial hole in DS
> security.
>
There is really no hole, it would be identical to password
authentication over a SSL channel.
The problem is currently existing installations may rely on that when
Kerberos user gets deleted or otherwise disabled, access to Kerberos
domain services would closed after all Kerberos tickets expire.
After this change in MIT Kerberos, the above policy will not be obeyed
at least until all the services will be updated to enforce the policy
themselves.