Mike Dopheide wrote: > In my experience only your TGT will be forwarded, not every ticket in your > credentials cache. The tickets have your IP address encoded in them so > during the forwarding process you're actually getting a new TGT with the > IP address of the remote system you're telnetting into.
Although addresses are not used in tickets that much, now that we have NAT changing addreses, the intent it to get a new ticket to forward which would only be usable from the server's location. There is also the possibility of adding restrictions into the ticket, that would limit how it could be used. Although not done today, it could be a very useful in the future. I see that you have AFS. Your question should now be how do a get an AFS token during login given the single forwarded TGT. > > -Mike > > >>*NOW* what am I doing wrong? :) Why are my other >>tickets not being forwarded? MIT Kerberos 1.4.3 >>telnet and telnetd in use. >> >>jblaine > klist -f >>Ticket cache: FILE:/tmp/krb5cc_p11561 >>Default principal: [EMAIL PROTECTED] >> >>Valid starting Expires Service principal >>05/22/06 15:20:08 05/23/06 01:20:08 krbtgt/[EMAIL PROTECTED] >> renew until 05/22/06 15:20:08, Flags: FRI >>05/22/06 15:22:03 05/23/06 01:20:08 host/[EMAIL PROTECTED] >> renew until 05/22/06 15:20:08, Flags: FRT >>05/22/06 15:22:20 05/23/06 01:20:08 afs/[EMAIL PROTECTED] >> renew until 05/22/06 15:20:08, Flags: FRT >> >> >>Kerberos 4 ticket cache: /tmp/tkt26560 >>klist: You have no tickets cached >> >>jblaine > telnet -a -F 192.168.168.3 >>Trying 192.168.168.3... >>Connected to noodle.foo.com (192.168.168.3). >>Escape character is '^]'. >>[ Kerberos V5 accepts you as [EMAIL PROTECTED]'' ] >>[ Kerberos V5 accepted forwarded credentials ] >>Last login: Mon May 22 15:22:03 from noodle >>Sun Microsystems Inc. SunOS 5.9 Generic May 2002 >>jblaine > klist -f >>Ticket cache: FILE:/tmp/krb5cc_p11616 >>Default principal: [EMAIL PROTECTED] >> >>Valid starting Expires Service principal >>05/22/06 15:22:28 05/23/06 01:20:08 krbtgt/[EMAIL PROTECTED] >> renew until 05/22/06 15:20:08, Flags: FfRT >> >> >>Kerberos 4 ticket cache: /tmp/tkt26560 >>klist: You have no tickets cached >>jblaine > >>________________________________________________ >>Kerberos mailing list [email protected] >>https://mailman.mit.edu/mailman/listinfo/kerberos >> > > ________________________________________________ > Kerberos mailing list [email protected] > https://mailman.mit.edu/mailman/listinfo/kerberos > > -- Douglas E. Engert <[EMAIL PROTECTED]> Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
