Re: restricting principals to certain commands only (like ssh's "forced command")

2011-01-31 Thread mikhail_teterin
On 31.01.2011 15:57, Frank Cusack wrote: > I recently added this support and will release it shortly. Thank you, Frank! Will this be an extension to the .k5login syntax, or something else? Yours, -mi > On 1/31/11 3:37 PM -0500 Mikhail T. wrote: >> Hello! >> >> We are using Kerberos throughou

Re: restricting principals to certain commands only (like ssh's "forced command")

2011-01-31 Thread Frank Cusack
On 1/31/11 4:20 PM -0500 mikhail_tete...@timeinc.com wrote: > On 31.01.2011 15:57, Frank Cusack wrote: >> I recently added this support and will release it shortly. > Thank you, Frank! Will this be an extension to the .k5login syntax, or > something else? Yours, It uses .k5users, exactly like ksu(

Re: restricting principals to certain commands only (like ssh's "forced command")

2011-01-31 Thread Frank Cusack
I recently added this support and will release it shortly. On 1/31/11 3:37 PM -0500 Mikhail T. wrote: > Hello! > > We are using Kerberos throughout, but one feature of ssh > "authorized_keys" feels missing... > > We'd like to be able to limit principles to only be able to execute > certain command

restricting principals to certain commands only (like ssh's "forced command")

2011-01-31 Thread Mikhail T.
Hello! We are using Kerberos throughout, but one feature of ssh "authorized_keys" feels missing... We'd like to be able to limit principles to only be able to execute certain commands. It would seem, that the ~/.k5users file allows that, but that is only consulted by ksu(1). How can I allow

Re: credentials cache type KRB5_FCC_FVNO_4

2011-01-31 Thread Tim Alsop
Hi, Does anybody have any information which would help us with the question below ? We are trying to understand why the time offset is stored in cache header when cache type 4 is used. Thanks, Tim On 14/01/2011 06:25, "Srinivas Cheruku" wrote: >Hi, > > > >>From code I found that, when a TGT i