but how do you auth the user? there is no setuid. you prove who you are to the auth server by typing a password that is kept locally and used to authenticate yourself. maybe things have changed a bit since the 1st release, but my guess is that the auth design is more or less the same. so you gotta enter some data to auth yourself. this data must _never_ cross the wire. so if you say server x is my preferred cron server, just how is server x's cron going to get the auth data to allow the cron to 'run as you'? 'running as you' is not a matter of uid's, it's a matter of proving that you are you with the auth data you've been given. wholesale shipping around private keys from auth to 'trusted' cpu servers to allow impersonation is just an accident waiting to happen. you bust the cpu server, you bust the auth server. and all that stuff is flying around on the wire. no, no and no. god, we may as well go back to rsh/rlogin -- yes, that hideous mess. (Embedded image moved "Fco. J. Ballesteros" to file: 18/07/2000 16:34 pic32656.pcx) Veuillez répondre à 9fans@cse.psu.edu Pour: 9fans@cse.psu.edu cc: (ccc: Boyd ROBERTS/EST/DOSI/BANQUE_INDOSUEZ/FR) Objet: [9fans] Auth & cron