On Wed, 4 Aug 2010 14:32:06 -0700 David Brodbeck <brodbd@xxxxxxxxxxxxxxxx> wrote: > > On Aug 4, 2010, at 11:30 AM, Andy Adamson wrote: > > > > > On Aug 4, 2010, at 1:06 PM, David Brodbeck wrote: > > > >> > >> On Aug 3, 2010, at 7:02 PM, Trond Myklebust wrote: > >> > >>> On Tue, 2010-08-03 at 18:42 -0400, J. Bruce Fields wrote: > >>>> On Tue, Aug 03, 2010 at 06:31:15PM -0400, Trond Myklebust wrote: > >>>>> On Tue, 2010-08-03 at 18:23 -0400, J. Bruce Fields wrote: > >>>>>> On Tue, Aug 03, 2010 at 06:15:19PM -0400, Trond Myklebust wrote: > >>>> > >>>>> 2) Why is AUTH_SYS so sacrosanct? > >>>> > >>>> Because it's what almost everyone uses. > >>> > >>> No. It's the _default_. ...and a really really bad default. > >> > >> The problem is the only supported alternative is to set up Kerberos. This is a lot of work, especially for established sites where it essentially requires every user to change their password during the migration. It also creates problems with ticket expiration if you have daemons or batch jobs that need continuous access to NFS filesystems. > > > > Changing passwords is a good thing - should be done on a regular basis anyway. > > True, Not true. Forced password changing encourages poor choice of passwords and other poor practices. Much better to choose a really good password and only change it when you have reason to believe that it has been compromised, or when you get bored of the old one. (better still is two-factor authentication of course). NeilBrown -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
