Kerberos issues for CDF institutions

The transition of all FNAL computers to the strong authentication methods (aka Kerberos) is a de-facto that we can not and will not try to stop.

The only concern of the ICRB is that offiste users get the needed support to enable them to connect to FNAL computers to keep working effectively for CDF.

The Fermilab Strong Authentication Team is the primary address for users to file requests, complains etc. This Board will only be involved if the users concerns are not addressed in a satisfactory manner

At present the Chairman of the Board understands that everything is fine and there is no problem. Poeple and/or institutions that feel otherwise should signal their problems so that action can be taken.

More explicitely, at present we assume that

• Kerberos client installation offisite is easy and straightforward
• instructions are available at http://www-cdf.fnal.gov/offline/runii/fcdfsgi2/krb5_quickstart.html and work
• users problems should be reported to kerberos-users mailing list.
• users who have to deal with kerberos issues are encouraged to subscribe to the kerberos-users mailing list and then browse the list archives as well to find answers
• Kerberos servers (aka host services, aka host principals) are available, require a little more care, but can be setup easily to allow secure transparent connection FROM Fnal TO remote sites when desired
• the Kerberos team at Fermilab is competently and promptly helping users with their problems if any.

Stefano Belforte. June 8, 2001.