North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Best practices inquiry: tracking SSH host keys
>If a deployed kerberos environment has a single point of failure then its >been deployed poorly. Kerberos has replication mechanisms to provide >redundancy. This concentrates on the "what if it fails" worst case scenario of a single point of failure. This doesn't answer the "what if it is subverted" worst case scenario of a single point of failure. (Other posters have noted the requirement to lock down the kerberos server tightly, but seemingly more with a view to keeping the server functioning, rather than keeping its data safe from exposure and corruption. The lock down mechanisms probably do both, but you need to keep both views in mind.) --Sandy
|