Received: from PACIFIC-CARRIER-ANNEX.MIT.EDU by po7.MIT.EDU (5.61/4.7) id AA20982; Tue, 26 Dec 95 17:33:14 EST Received: by MIT.EDU id AA10476; Tue, 26 Dec 95 17:32:54 EST Date: Tue, 26 Dec 95 17:32:54 EST From: MAILER-DAEMON@MIT.EDU (Mail Delivery Subsystem) Subject: Returned mail: Cannot send message for 3 days Message-Id: <9512262232.AA10476@MIT.EDU> To: To: proven@PO7.LOCAL To: tytso@PO9.LOCAL To: basch@lehman.com To: jis@E40-PO.LOCAL To: tlyu@PO9.LOCAL ----- Transcript of session follows ----- 421 pyro.rh.imsa.edu.tcp... Deferred: Connection timed out during user open with pyro.rh.imsa.edu 451 hangman@pyro.rh.imsa.edu... Cannot send message for 3 days hangman@pyro.rh.imsa.edu... Cannot send message for 3 days ----- Unsent message follows ----- Received: from toxicwaste.media.mit.edu by MIT.EDU with SMTP id AA02042; Sat, 23 Dec 95 17:20:53 EST Received: (from warlord@localhost) by toxicwaste.media.mit.edu (8.6.10/8.6.10) id RAA06415; Sat, 23 Dec 1995 17:20:58 -0500 Date: Sat, 23 Dec 1995 17:20:58 -0500 From: Derek Atkins Message-Id: <199512232220.RAA06415@toxicwaste.media.mit.edu> To: "Calvin G. Smith" Cc: kerberos@MIT.EDU In-Reply-To: "[6401] in Kerberos" Subject: Re: Thinking of moving to kerberos, lots of questions Hi. > We are considering moving our system from YP to Kerberos. Before I > undertake this, are there any pitfalls, etc. to watch out for? First, remember that kerberos is an authentication system, YP is a naming service. > How would I move the password database from the YP files to the Kerberos > KDC? Would everyone have to reenter their passwords, or is there a way > that it could be done so that it is as transparent as possible to the > users? You cannot directly convert from YP passwords to Kerberos passwords. You will need to create each user in the KDC by hand, which does require everyone to enter their password. Or, perhaps, you can provide a program that will use the YP password and stuff it into the KDC (this _can_ be a security hole if left too long). For example, you can hack login to first try the KDC for a password, and if that fails, try YP. If YP succeeds, then add the password to the KDC. This just requires the hacked login program to understand the kadmin protocol and have a kadmin password stored inside. -derek