LHC Computer Grid - Rollout
> [mailto:[log in to unmask]] On Behalf Of Gidon Moont
said:
> But, with a given valid proxy (voms AC added or not), I can
> ask for a new VOMS AC (no password needed) and chain the proxy...
Not necessarily, the VOMS servers impose some limits on what requests
are allowed to prevent privilege escalation with stolen proxies,
although I don't remember exactly what is and isn't allowed.
Stephen
|