[22216] in Kerberos
Re: Can't get ssh over k5/afs working well
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Tue Aug 17 14:34:22 2004
Message-ID: <41224E72.5040308@anl.gov>
Date: Tue, 17 Aug 2004 13:29:06 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Sam Hartman <hartmans@mit.edu>
In-Reply-To: <tslsmalohp5.fsf@cz.mit.edu>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
cc: Sensei <noone@nowhere.org>
Errors-To: kerberos-bounces@mit.edu
Sam,
I was just looking at the OpenSSH-3.8 whihc is in testing, to see
how I could get ride of my last mod. It was geting an AFS token.
I was developing a pam_afs2.so wihc had a pam_sm_open_session
routine that would look for the KRB5CCNAME in the pam environment
so aklog could be called.
But to get this set by the OpenSSH code required the call to
ssh_gssapi_storecreds to be moved up somewhat in the code.
It sounds like debian has done something simmiliar.
Is the code available? Did you need OpenSSH modifications?
The intent of the change was to seperate out and requirement
of OpenSSH to be compiled with any AFS code, and to not require
pam_krb5 to have any knowledge of AFS as well. All that is
needed is for OpenSSH or pam_krb5 to have established the
ticket cache and set KRB5CCNAME. Then the pam_afs2 would
get a PAG and call aklog.
Sam Hartman wrote:
> In debian, using the ssh-krb5 package with a pam config like:
>
> auth [success=ok default=1] pam_krb5.so forwardable
> auth [default=1] pam_permit.so
> auth required pam_unix.so try_first_pass
> auth [default=ignore] pam_openafs_session.so
>
>
> should mostly do what you want.
>
> Note that the ssh gssapi support between 3.4/3.6 and 3.8 is
> incompatible.
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
