<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 26.07.2016 13:38, Simo Sorce wrote:<br>
</div>
<blockquote cite="mid:1469533105.18067.89.camel@redhat.com"
type="cite">
<pre wrap="">On Mon, 2016-07-25 at 11:26 -0400, Simo Sorce wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Mon, 2016-07-25 at 11:10 -0400, Rob Crittenden wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Simo Sorce wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Mon, 2016-07-25 at 10:55 -0400, Rob Crittenden wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Simo Sorce wrote:
</pre>
<blockquote type="cite">
<pre wrap="">As described in #232 start restricting the use of the setkeytab
operation to just the computers objects.
I haven't tested this with older RHEL/CentOS machines that actully use
the setkeytab operation as I do not have such an old VM handy right now.
Meanwhile I'd like to know if ppl agree with this approach.
</pre>
</blockquote>
<pre wrap="">
What about services?
</pre>
</blockquote>
<pre wrap="">
Do we automatically acquire keytab for services in the old clients ?
Are you thinking about scripted ipa-getkytab callouts ?
</pre>
</blockquote>
<pre wrap="">
You are limiting access to host keytabs, what about service keytabs?
Should they be or are they now similarly restricted?
Installers for something like Foreman may try to generate a service
keytab in its installer, probably using admin credentials. I am planning
to do the same in Openstack.
</pre>
</blockquote>
<pre wrap="">
Ok I'll amend the patch to allow service keytabs to still use the
setkeytab control still, and restrict only users.
However note that the idea of using this method is that admin can change
this default on their own, so they can restrict more or less if they
want, to that end I need to remember how to set a default that we do not
override in the update file.
Simo.
</pre>
</blockquote>
<pre wrap="">Amended patch to allow services too.
Only users are excluded.
Simo.
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
bump for review<br>
</body>
</html>