Re: Solaris ssh pam_krb

2006-03-30 Thread Jeffrey Hutzelman
On Wednesday, March 29, 2006 04:12:12 PM -0600 Nicolas Williams [EMAIL PROTECTED] wrote: On Wed, Mar 29, 2006 at 03:53:33PM -0600, Douglas E. Engert wrote: Nicolas Williams wrote: On Wed, Mar 29, 2006 at 03:24:24PM -0600, Will Fiveash wrote: On Wed, Mar 29, 2006 at 10:02:54AM -0600,

Re: Solaris ssh pam_krb

2006-03-30 Thread Nicolas Williams
On Thu, Mar 30, 2006 at 06:58:39PM -0500, Jeffrey Hutzelman wrote: On Wednesday, March 29, 2006 04:12:12 PM -0600 Nicolas Williams wrote: The last two supplementary groups add up to a PAG thing? That won't go over well :) Actually, that's what AFS does, except it's the _first_ two groups;

Re: Solaris ssh pam_krb

2006-03-30 Thread Jeffrey Hutzelman
On Thursday, March 30, 2006 06:08:10 PM -0600 Nicolas Williams [EMAIL PROTECTED] wrote: On Thu, Mar 30, 2006 at 06:58:39PM -0500, Jeffrey Hutzelman wrote: On Wednesday, March 29, 2006 04:12:12 PM -0600 Nicolas Williams wrote: The last two supplementary groups add up to a PAG thing? That

Re: Solaris ssh pam_krb

2006-03-30 Thread Nicolas Williams
On Thu, Mar 30, 2006 at 08:02:14PM -0500, Jeffrey Hutzelman wrote: On Thursday, March 30, 2006 06:08:10 PM -0600 Nicolas Williams [EMAIL PROTECTED] wrote: Huh? Why should UIDs not conflict with PAGs? What am I missing? Because AFS identifies credentials, cached connections, and cached

Re: Solaris ssh pam_krb

2006-03-30 Thread Nicolas Williams
On Thu, Mar 30, 2006 at 09:12:50PM -0500, Jeffrey Hutzelman wrote: On Thursday, March 30, 2006 07:41:05 PM -0600 Nicolas Williams [EMAIL PROTECTED] wrote: No, the kernel doesn't need PAGs for itself -- it upcalls to daemons that do (e.g., gssd(1M)) and which can use door_ucred(3DOOR)

AB 2191

2006-03-30 Thread Brian McInnis
Dear Kerberos Team: My name is Brian McInnis and I am working with California State Assemblywoman Lois Wolk to push AB 2191, a bill asking the Secretary of State to create a pilot program to test the internet security protocol necessary to register a person to vote (validate an affidavit)

Re: Kerberos and Solaris 9 problems

2006-03-30 Thread Richard E. Silverman
Hey all, I'm trying to configure a Solaris 9 server to authenticate against an Win 2000 ADS server with mixed results and was looking for some insight. So here's the thing; Once logged in, I can run kinit and aquire a ticket: # kinit Password for [EMAIL PROTECTED]: #