[33463] in Kerberos
Re: [OpenAFS] Re: Help: Can OpenSSH get OpenAFS token after the
daemon@ATHENA.MIT.EDU (Lee Eric)
Sat Jun 11 10:28:13 2011
MIME-Version: 1.0
In-Reply-To: <alpine.LRH.2.00.1106110716160.24038@telemark.slac.stanford.edu>
Date: Sat, 11 Jun 2011 22:28:09 +0800
Message-ID: <BANLkTikjH6APq_wNJ6EDBuiLJgR1d4V_ig@mail.gmail.com>
From: Lee Eric <openlinuxsource@gmail.com>
To: Booker Bense <bbense@slac.stanford.edu>
Cc: OpenAFS <openafs-info@openafs.org>, "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Thanks all mates. It's fixed now.
Eric
On Sat, Jun 11, 2011 at 10:20 PM, Booker Bense <bbense@slac.stanford.edu> wrote:
>
> For various reasons[1] I've found that the pam solution doesn't cover all
> bases and I've resorted to putting aklog in
>
> /etc/ssh/sshrc
>
> If you have an sshrc it needs to deal with the xauth stuff as well.
>
> #
> # Evil workaround for pam sshd stupidity.
> if [ -n "$KRB5CCNAME" ] && [ -x /usr/bin/aklog ]; then
> /usr/bin/aklog
> fi
> if read proto cookie && [ -n "$DISPLAY" ]; then
> if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then
> # X11UseLocalhost=yes
> echo add unix:`echo $DISPLAY |
> cut -c11-` $proto $cookie
> else
> # X11UseLocalhost=no
> echo add $DISPLAY $proto $cookie
> fi | /usr/bin/xauth -q -
> fi
>
> - Booker C. Bense
>
> [1]- To be honest I've forgotten exactly what the combination was, but there
> was one edge case that I just couldn't get the
> pam based solution to work. The sshrc solution is also required
> on OS X.
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
