From owner-freebsd-security Tue Oct 19 6:58: 5 1999 Delivered-To: freebsd-security@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id EBF1015066 for ; Tue, 19 Oct 1999 06:57:59 -0700 (PDT) (envelope-from robert@cyrus.watson.org) Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.9.3/8.9.3) with SMTP id JAA33559 for ; Tue, 19 Oct 1999 09:57:59 -0400 (EDT) (envelope-from robert@cyrus.watson.org) Date: Tue, 19 Oct 1999 09:57:59 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org Reply-To: Robert Watson To: freebsd-security@freebsd.org Subject: Kerberos tickets in /tmp -- or somewhere else? Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Does anyone know if there's a way to make our default-installed K4 move it's tickets somewhere other than /tmp without rebuilding? /tmp on my busy machines gets filled with ticket files (sometimes many for a particular user with different variations on the same name). On CMU's Andrew workstations, they make use of a /tkt with restrictive access rights for ticket files, which can be cleaned seperately from /tmp, and more importantly, in a different namespace. It sounds like the kind of thing that's hardcoded (and if I remember from my last source inspection, it is), but perhaps we could make it something configurable? I guess there is no tradition of a /etc/kerberosIV/krb.rc (.conf already taken) with a configuration namespace and names/values :-). This could also be used to configure other host-based policy--maximum ticket lifespans that the library should acquire, defaults for ticket-passing behavior once we get K5, etc. Installing a customer Kerberos on my machines to get a prettier /tmp sounds unfortunate, and definitely increases the time-to-make-useful on machine installs. Thanks, Robert N M Watson robert@fledge.watson.org http://www.watson.org/~robert/ PGP key fingerprint: AF B5 5F FF A6 4A 79 37 ED 5F 55 E9 58 04 6A B1 TIS Labs at Network Associates, Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message