Messages in this thread | | | Subject | Re: PROPOSAL: Process Authentication Groups (PAGs) (fwd) | From | Marc Horowitz <> | Date | 19 Feb 1998 19:21:27 -0500 |
| |
IMHO, PAGs are a poor model for what you are trying to do. I understand the idea here, but I believe they are flawed in a few ways. First, I like that with kerberos or ssh, the user can choose which of the available ticket files/agents/whatever to use. I often switch between kerberos tickets in a single shell. Retyping the password each time would be inconvenient, at best. If there is no way to truly "set" the PAG, but only to create a new PAG, then substantial functionality which I used on a daily basis is lost. Second, I don't believe the kernel is the right place to store this data. Certainly, the kernel may need access to it, but this is inherently user data, not system data. Kernel storage makes certain useful techniques, such as credential forwarding or smartcards, difficult. I'd rather not see smartcard interaction code in my kernel.
Feel free to forward this to other appropriate forums.
Marc
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu
| |