[31783] in Kerberos
Re: Kerberos tickets, SSH public key auth, AFS tokens
daemon@ATHENA.MIT.EDU (Russ Allbery)
Wed Dec 16 22:24:53 2009
From: Russ Allbery <rra@stanford.edu>
To: Jeff Blaine <jblaine@stage-infinity.com>
In-Reply-To: <4B29A38D.3090405@stage-infinity.com> (Jeff Blaine's message of
"Wed, 16 Dec 2009 22:20:45 -0500")
Date: Wed, 16 Dec 2009 19:24:11 -0800
Message-ID: <87ws0mxoys.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Jeff Blaine <jblaine@stage-infinity.com> writes:
> Yup, they're there, just no tokens. I even tried a pam_krb5RA2.so and
> pam_afs_session2.so built against the Sun kerberos instead of our local
> MIT kerberos for kicks. Same result.
> ~:faron> kdestroy
> ~:faron> logout
> Connection to faron closed.
> ~:cairo> /usr/bin/ssh -o "GSSAPIDelegateCredentials yes" faron
> ~:faron> klist
> Ticket cache: FILE:/tmp/krb5cc_26560
> Default principal: jblaine@RCF.FOO.ORG
> Valid starting Expires Service principal
> 12/16/09 22:18:51 12/23/09 19:05:33 krbtgt/RCF.FOO.ORG@RCF.FOO.ORG
> renew until 12/23/09 19:05:33
> Kerberos 4 ticket cache: /tmp/tkt26560
> klist: You have no tickets cached
> ~:faron>
Oh, right, I remember this problem now. This is why Douglas has another
PAM module that does nothing except set KRB5CCNAME in the environment for
use on Solaris. Solaris uses the default UID-based ticket cache and hence
doesn't set KRB5CCNAME in the environment.
Try adding always_aklog to the pam_afs_session configuration.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
