[33465] in Kerberos
Re: Re: Help: Can OpenSSH get OpenAFS token after the client login?
daemon@ATHENA.MIT.EDU (Markus Moeller)
Sat Jun 11 13:32:30 2011
To: kerberos@mit.edu
From: "Markus Moeller" <huaraz@moeller.plus.com>
Date: Sat, 11 Jun 2011 18:22:27 +0100
Message-ID: <it08ql$jq1$1@dough.gmane.org>
Mime-Version: 1.0
X-Complaints-To: usenet@dough.gmane.org
In-Reply-To: <alpine.LRH.2.00.1106110716160.24038@telemark.slac.stanford.edu>
Cc: openafs-info@openafs.org
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
If I remember right when GSSAPIauthentication is used and the client has a
valid Kerberos ticket pam won't be called on the server, so the pam module
won't help in that case.
Markus
"Booker Bense" <bbense@slac.stanford.edu> wrote in message
news:alpine.LRH.2.00.1106110716160.24038@telemark.slac.stanford.edu...
>
> For various reasons[1] I've found that the pam solution doesn't cover all
> bases and I've resorted to putting aklog in
>
> /etc/ssh/sshrc
>
> If you have an sshrc it needs to deal with the xauth stuff as well.
>
> #
> # Evil workaround for pam sshd stupidity.
> if [ -n "$KRB5CCNAME" ] && [ -x /usr/bin/aklog ]; then
> /usr/bin/aklog
> fi
> if read proto cookie && [ -n "$DISPLAY" ]; then
> if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ];
> then
> # X11UseLocalhost=yes
> echo add unix:`echo $DISPLAY |
> cut -c11-` $proto $cookie
> else
> # X11UseLocalhost=no
> echo add $DISPLAY $proto $cookie
> fi | /usr/bin/xauth -q -
> fi
>
> - Booker C. Bense
>
> [1]- To be honest I've forgotten exactly what the combination was, but
> there was one edge case that I just couldn't get the
> pam based solution to work. The sshrc solution is also required
> on OS X.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
