Received: from PACIFIC-CARRIER-ANNEX.MIT.EDU by po7.MIT.EDU (5.61/4.7) id AA21813; Wed, 13 Dec 95 05:50:14 EST Received: from pad-thai.cam.ov.com by MIT.EDU with SMTP id AA16878; Wed, 13 Dec 95 04:22:17 EST Date: Wed, 13 Dec 95 04:22:17 EST From: MAILER-DAEMON@MIT.EDU (Mail Delivery Subsystem) Subject: Returned mail: Deferred: Connection refused by vnet.ibm.com Message-Id: <9512130922.AA16878@MIT.EDU> To: owner-kerberos@MIT.EDU ----- Transcript of session follows ----- 421 cs.washington.edu.tcp... Deferred: Connection timed out during user open with trout.cs.washington.edu 451 dmsmith@ecoult.ncsu.edu... reply: read error 451 dmsmith@ecoult.ncsu.edu... reply: read error 421 tgv.com.tcp... Deferred: Connection timed out during user open with Fang.TGV.COM 451 Mack@rus.uni-stuttgart.de... reply: read error 451 Mack@rus.uni-stuttgart.de... reply: read error 451 pfenning@techfak.uni-bielefeld.de... reply: read error 451 pfenning@techfak.uni-bielefeld.de... reply: read error 451 uk-kerberos@doc.ic.ac.uk... reply: read error 451 uk-kerberos@doc.ic.ac.uk... reply: read error 421 ocsg.com.tcp... Deferred: Connection timed out during user open with kerby.ocsg.com 451 habs@inesc.pt... reply: read error 451 habs@inesc.pt... reply: read error >>> RCPT To: <<< 553 unknown or illegal user: DJMSYS@ritvax.isc.rit.edu 550 DJMSYS@ritvax.isc.rit.edu... User unknown 451 joe@sch.bme.hu... reply: read error 451 joe@sch.bme.hu... reply: read error 421 vix.com.tcp... Deferred: Connection timed out during user open with gw.home.vix.com 421 rce.com.tcp... Deferred: Connection timed out during user open with gw.home.vix.com 421 notes.pw.com.tcp... Deferred: Connection timed out during user open with jasmine.tc.pw.com 421 austin.vnet.ibm.com.tcp... Deferred: Connection refused by vnet.ibm.com 421 sun0.cs.plu.edu.tcp... Deferred: Connection timed out during user open with sun0.cs.PLU.edu 421 cybersafe.com.tcp... Deferred: Connection timed out during user open with kerby.ocsg.com 421 vnet.ibm.com.tcp... Deferred: Connection refused by vnet.ibm.com 421 twig.com.tcp... Deferred: Connection timed out during user open with edge.twig.com 421 scu.edu.au.tcp... Deferred: Connection timed out during user open with alsvid.scu.edu.au 421 pyro.rh.imsa.edu.tcp... Deferred: Connection timed out during user open with pyro.rh.imsa.edu 421 portals.pdx.edu.tcp... Deferred: Connection timed out during user open with portals.pdx.edu 421 rchland.vnet.ibm.com.tcp... Deferred: Connection refused by vnet.ibm.com ----- Unsent message follows ----- Received: from pad-thai.cam.ov.com by MIT.EDU with SMTP id AA16744; Wed, 13 Dec 95 04:22:17 EST Received: by pad-thai.cam.ov.com (8.6.12/) id ; Wed, 13 Dec 1995 04:25:03 -0500 Received: from GATEWAY by pad-thai.cam.ov.com with netnews for kerberos-wrapper@cam.ov.com (kerberos@mit.edu) To: kerberos@MIT.EDU Date: 13 Dec 1995 09:19:23 GMT From: jik@annex-1-slip-jik.cam.ov.com (Jonathan Kamens) Message-Id: <4am5qr$rcp@jik.datasrv.co.il> Organization: jik's Linux box Sender: usenet@cam.ov.com References: <4am1ft$npk@sun.rhbnc.ac.uk> Subject: Re: Kinit from cron script First of all: You don't really want to do this. Running kinit from a cron script and feeding the password into it implies that the password is hard-coded into the script. That is a Bad Thing. If you must do this, then extract the key for which you want to get tickets into a keytab/srvtab file, put that file in a hidden directory somewhere that's only readable the UID that the script runs under, and then use "kinit -k" (that's under V5; I believe the equivalent under V4 is ksrvtgt; you should mention when you post to comp.protocols.kerberos whether you're using V4 or V5, and what version you're using) to get tickets from the keytab. In absolute terms, the amount of risk in doing this if you do everything properly is the same as if you hard-code the password in the script (assuming that the script is only readable by the UID executing it), but doing it with a keytab makes compromises much less likely. Second: If you really must hard-code a password in a script, then get Expect and use it to talk to kinit. Problems like this are what Expect was designed for. For more information about Expect, see "Exploring Expect: A Tcl-Based Toolkit for Automating Interactive Applications", ISBN 1-56592-090-2, published by O'Reilly (see the next paragraph for more information about the book), or just get expect from and read the documentation files that come with it. Here's more information about the book (from the README file that comes with Expect): If you have access to World Wide Web, here are some related URLs: one-paragraph description (from O'Reilly catalog): http://www.ora.com/gnn/bus/ora/item/expect.html one-page description (from back cover of book): http://www.ora.com/gnn/bus/ora/item/expect.desc.html front cover - picture and description: http://www.ora.com/gnn/bus/ora/item/expect.cover.html To order: Via email: order@ora.com Via the web: http://www.ora.com/gnn/bus/ora/ordering/index.html Via phone (Weekdays 6am-6pm PST): 800-889-9938 or 707-829-0515 Publisher's address: O'Reilly & Associates, Inc. 103A Morris Street Sebastopol, CA 95472