[22804] in Kerberos
Re: problem setting up ssh-krb5 from Debian Sarge
daemon@ATHENA.MIT.EDU (Christopher D. Clausen)
Tue Nov 2 13:26:11 2004
Message-ID: <01e601c4c0a4$227a81c0$1909000a@ad.uiuc.edu>
From: "Christopher D. Clausen" <cclausen@uiuc.edu>
To: <kerberos@mit.edu>
Date: Tue, 2 Nov 2004 00:21:02 -0600
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Wes Chow wrote:
>> Well, check your /etc/hosts file. I believe that Debian puts the
>> hostname on the 127.0.0.1 line. This is not good.
>
> Yeah I saw other postings about that, so I fixed it...
>
>> You have libpam-openafs-session installed. Are you using it as a
>> session module also?
>> session required pam_openafs_session.so
>
> I tried putting that line in /etc/pam.d/common-session and now I'm
> getting this in auth.log:
>
> Oct 30 01:09:18 jack sshd[529]: Authorized to wchow, krb5 principal
> wchow@D2702.
> ATHENACR.COM (krb5_kuserok)
> Oct 30 01:09:18 jack sshd[529]: pam_openafs-krb5: open_session: Could
> not find K
> erberos tickets; not running aklog
> Oct 30 01:09:18 jack sshd[529]: (pam_unix) session opened for user
> wchow by (uid
> =0)
> Oct 30 01:09:18 jack sshd[529]: Accepted gssapi for wchow from
> 192.168.0.16 port
> 33003 ssh2
I assume that you have "UsePrivilegeSeparation no" in your sshd_config
file? as having this set to yes seems to cause the behaviour that you
describe with not getting AFS tokens at login.
<<CDC
Christopher D. Clausen
ACM@UIUC SysAdmin
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
