RE: Mapping userPassword to Kerberos 5

["Howard Chu" <hyc@highlandsun.com>]

> -----Original Message-----
> From: owner-openldap-software@OpenLDAP.org
> [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of Stephen Frost

> I'd love to get some feedback from people on this, perhaps there are
> other cases where authentication through LDAP to Kerberos makes some
> sense.  Or perhaps there are other problems with pam_krb5 I've not run
> into.  If there's enough demand for the Debian packages to be compiled
> with --enable-kpasswd we may be willing to do this in the future.

As I've posted before - for the reasons you outline, we strongly discourage
people from using this kpasswd stuff. Likewise for pam_krb5; any mechanism
that lets you send a Kerberos password across a network completely defeats
whatever security Kerberos had to offer.

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support