[22273] in Kerberos
Re: SSH with K5/AFS: anyone?
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Wed Aug 25 16:58:34 2004
Message-ID: <412CFBCF.9080007@anl.gov>
Date: Wed, 25 Aug 2004 15:51:27 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Sensei <noone@nowhere.org>
In-Reply-To: <2p3gvpFgg6vcU1@uni-berlin.de>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Sensei wrote:
> Hi. I don't have luck with SSH and K5/AFS. I'm trying to make a
> passwordless ssh trusting the k5 tickets and granting the access to afs
> using aklog (pam_openafs_session).
>
> I have these configuration: server with debian stable, ssh 3.6 ---
> clients with gentoo ssh 3.9, nothing seems to work properly. I tried
> some solutions:
>
> - UsePAM yes PasswordAuthentication yes does not work
> - Kerberos* yes does not work
> - Kerberos* yes GSSAPI* does not work
> - PriviledgeSeparation no/yes does not work
> - ...
>
> I don't have an idea. I waited till ssh 3.9, but nothing.
See http://bugzilla.mindrot.org/show_bug.cgi?id=918
as a start.
>
> Has anyone *EVER* succeeded in using passwordless ssh with kerberos and afs?
>
Yes use it all the time with gssapi. But we have a local mod to
get the PAG and token. The above patch to 3.9 should allow the
pam_openafs_session to see the KRB5CCNAME, or is a start so the
pam_openafs_session can be convertd to a pam_sm_setcred to
use the KRB5CCNAME in all cases.
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
