Re: kadmin: failing dump/load
Viktor Dukhovni <[email protected]> Mon, 13 Nov 2017 12:57:34 -0500
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Message-ID | <[email protected]> |
> On Nov 13, 2017, at 12:50 PM, Patrik Lundin <[email protected]> wrote: > > Maby it is just me but I was surprised to have "get" not reflect the > actual contents in the database. IIRC that was needed to reliably get pruning to work, since some kadmin clients add keys by doing get + add + set. We also did not want users with "get" privileges on the key values to get old keys that can only be used to compromise captured traffic, and are not needed for live keytab files. Perhaps I am not recalling the details quite right, but it made sense at the time... -- Viktor.