The hope is that the proxy will read requests and validate them. Thus passing through the proxy would be less dangerous that exposing port 88 directly. If that’s not true, we should consider the risks of making port 88 available, or give up.
> On Sep 11, 2021, at 7:07 PM, Ken Hornstein <k...@cmf.nrl.navy.mil> wrote: > > >> >> Another use case is getting tickets for Mac users. We have a few users >> that ssh into enough different hosts that they want to use kerberized >> ssh. Unless we open port 88 to the outside, they have to install Mac >> ports and use the MIT kinit. > > So they can't open port 88 to the outside, but port 88-via-80 is fine? > > --Ken ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos
