[33462] in Kerberos
Re: [OpenAFS] Re: Help: Can OpenSSH get OpenAFS token after the
daemon@ATHENA.MIT.EDU (Booker Bense)
Sat Jun 11 10:20:32 2011
Date: Sat, 11 Jun 2011 07:20:18 -0700 (PDT)
From: Booker Bense <bbense@slac.stanford.edu>
To: Lee Eric <openlinuxsource@gmail.com>
In-Reply-To: <BANLkTikN=4+et3ZWfyHb=HCAdLh9y1wdAA@mail.gmail.com>
Message-ID: <alpine.LRH.2.00.1106110716160.24038@telemark.slac.stanford.edu>
MIME-Version: 1.0
Cc: OpenAFS <openafs-info@openafs.org>, "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
For various reasons[1] I've found that the pam solution doesn't
cover all bases and I've resorted to putting aklog in
/etc/ssh/sshrc
If you have an sshrc it needs to deal with the xauth stuff as
well.
#
# Evil workaround for pam sshd stupidity.
if [ -n "$KRB5CCNAME" ] && [ -x /usr/bin/aklog ]; then
/usr/bin/aklog
fi
if read proto cookie && [ -n "$DISPLAY" ]; then
if [ `echo $DISPLAY | cut -c1-10` =
'localhost:' ]; then
# X11UseLocalhost=yes
echo add unix:`echo $DISPLAY |
cut -c11-` $proto $cookie
else
# X11UseLocalhost=no
echo add $DISPLAY $proto $cookie
fi | /usr/bin/xauth -q -
fi
- Booker C. Bense
[1]- To be honest I've forgotten exactly what the combination
was, but there was one edge case that I just couldn't get the
pam based solution to work. The sshrc solution is also required
on OS X.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
