search for: kaf

Would OpenSSH be willing to accept a modification similar to the one below to replace the kafs modification to get an AFS PAG and token? The nice features of this are that it can be compiled in even if OpenAFS is not available. At runtime if the dynamic library is present, it can be loaded and called. A dynamic lib is used so the setpag is in the same process. It has been reported that...

...w working with openssh-2.9p2): gcc -o ssh ssh.o sshconnect.o sshconnect1.o sshconnect2.o sshtty.o readconf.o clientloop.o -L. -Lopenbsd-compat/ -R/usr/local/ssl/lib -L/usr/local/ssl/lib -L/usr/local/lib -R/usr/local/lib -L/usr/athena/lib -R/usr/athena/lib -L/usr/afsws/lib -lssh -lopenbsd-compat -lkafs -lresolv -ldes -lkrb -lpam -ldl -lwrap -lz -lsocket -lnsl -lgen -lcrypto -ldes /usr/local/ssl/lib/libcrypto.a(set_key.o): In function `des_check_key_parity': set_key.o(.text+0x380): multiple definition of `des_check_key_parity' /usr/local/lib/libdes.a(key_parity.o)(.text+0x98): first defi...

FYI, During my bi-weekly yum update, I noted the following warnings. Warnings during kernel update kernel-2.6.9-22.0.1.106.unsupported WARNING: /lib/modules/2.6.9-22.0.1.106.unsupported/kernel/fs/afs/kafs.ko needs unknown symbol afs_key_unregister WARNING: /lib/modules/2.6.9-22.0.1.106.unsupported/kernel/fs/afs/kafs.ko needs unknown symbol afs_key_register Is this anything to worry about? If I read this right, the error is for AFS, and I could care less whether AFS works or not. -- Collins Richey...

...ine __BIT_TYPES_DEFINED__ #endif /* 64-bit types */ MM> sshconnect1.c: In function `send_afs_tokens': MM> sshconnect1.c:543: warning: implicit declaration of function `_IOW' MM> sshconnect1.c:543: parse error before `struct' MM> make: *** [sshconnect1.o] Error 1 --- kafs.h~ Tue Dec 12 15:53:47 2000 +++ kafs.h Fri Dec 15 12:22:05 2000 @@ -36,6 +36,9 @@ #ifndef __KAFS_H #define __KAFS_H +/* need _IOW on Solaris , 15.12.00 JI */ +#include <sys/ioccom.h> + /* XXX must include krb5.h or krb.h */ /* sys/ioctl.h must be included manually before kafs.h */ Be...

.../* AFS */ +#endif /* KRB4 */ --- auth.h 2002/01/23 12:01:53 1.1 +++ auth.h 2002/01/23 12:14:19 @@ -102,14 +102,15 @@ int auth_krb4(Authctxt *, KTEXT, char **); int auth_krb4_password(Authctxt *, const char *); void krb4_cleanup_proc(void *); +#endif /* KRB4 */ #ifdef AFS #include <kafs.h> +#ifdef KRB4 int auth_krb4_tgt(Authctxt *, const char *); int auth_afs_token(Authctxt *, const char *); -#endif /* AFS */ - #endif /* KRB4 */ +#endif /* AFS */ #ifdef KRB5 int auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client); --- auth1.c 2002/01/23 12:15:49 1.1 ++...

- I'm not really sure if this is a bug in openssh or in Kth's krb4-1.1. Anyway, if you define --with-afs=/usr/athena[1] and --with-kerberos4=/usr/athena on Solaris 2.7, you need to apply this minor patch to get the client to build. - You could argue that kafs.h should include these sys files since it uses macros inside them. - Booker C. Bense [1]- Where kth installs by default. diff -u -r1.1.1.1 sshconnect1.c --- sshconnect1.c 2001/10/01 18:18:47 1.1.1.1 +++ sshconnect1.c 2001/10/02 22:53:09 @@ -25,6 +25,8 @@ #include <krb5.h&gt...

...[--deps] display the dependent libs required for static linking libraries: krb5 Kerberos 5 applications gssapi GSSAPI applications kadm-client libkadm5 client kadm-server libkadm5 server kafs kafs (2) Attempt with embedded heimdal On the other hand, if try to build with the embedded heimdal, it proceeds to build heimdal, but then errors during linking since ld can't resolve "libintl_dgettext". But this is strange since I confirmed that this symbol is present...

Rather then implementing kafs in MIT Kerberos, I would like to suggest an alternative which has advantages to all parties. The OpenSSH sshd needs to do two things: (1) sets a PAG in the kernel, (2) obtains an AFS token storing it in the kernel. It can use the Kerberos credentials either obtained via GSSAPI delegat...

...2003/12/23 16:12:10 implement KerberosGetAFSToken server option. ok markus@, beck@ - markus at cvs.openbsd.org 2003/11/02 11:01:03 remove support for SSH_BUG_GSSAPI_BER; simon at sxw.org.uk Changes in -Portable only - (dtucker) Only enable KerberosGetAFSToken if Heimdal's libkafs is found. with jakob@ - (dtucker) [configure.ac] Use krb5-config where available for Kerberos/GSSAPI detection, libs and includes. ok djm@ Additionally, as a side effect of the last change, the test for libkafs is now independant of the Heimdal test, so should a version that works...

Please pardon the repeat posting, here, but I hope to get better response with a proper subject line. I am attempting to build OpenSSH on AIX in AFS environment. I've succeeded in building Zlib and OpenSSL, but OpenSSH insists that it needs krb.h, kafs.h, and perhaps libkrb. I have not found any of these on this AIX machine (nor on others I've checked). The INSTALL document seems to insist that the --with-kerberos4 option is required for AFS (as is --with-AFS, of course). If someone can explain exactly what is necessary, and where to find...

...rb.h: present but cannot be compiled configure: WARNING: krb.h: check for missing prerequisite headers? configure: WARNING: krb.h: proceeding with the preprocessor's result checking for krb.h... yes The build fails at this point -- "./auth.h", line 114: cannot find include file: <kafs.h> "monitor_wrap.c", line 613: warning: argument #2 is incompatible with prototype: prototype: pointer to const char : "/usr/include/string.h", line 72 argument : pointer to unsigned char cc: acomp failed for monitor_wrap.c make: *** [monitor_wrap.o] Error 2...

Can anyone with Heimdal KrbV verify this? -------------- next part -------------- An embedded message was scrubbed... From: Dag-Erling Smorgrav <des at ofug.org> Subject: Kerberos buglet in OpenSSH-3.3p1 Date: 25 Jun 2002 14:52:10 +0200 Size: 1291 Url: http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20020626/347e123e/attachment.mht

...local/man --with-pid-dir=/etc/ssh --with-ipv4-default --with-default-path=/usr/bin:/bin:/usr/sbin:/sbin:/usr/afsws/bin:/usr/local/bin:. My guess is that the --with-afs flag was the one which required radix.o to be built and linked. In sshconnect1.c, radix.h is included by: #ifdef AFS #include <kafs.h> #include "radix.h" #endif ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.

...org openssh-3.6.1p1-1.src.rpm Tried the following to compile. [root at blueray openssh-3.6.1p1]# ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-kerberos5=/usr/kerberos --with-afs=/usr/afs [root at blueray openssh-3.6.1p1]# make Following error obtained. sshconnect1.c:31:18: kafs.h: No such file or directory make: *** [sshconnect1.o] Error 1 [root at blueray openssh-3.6.1p1]#

The previous version broke the case of internal-sftp without arguments. This is a fixed version. --- /var/tmp/session.c 2008-08-18 21:07:10.000000000 -0700 +++ session.c 2008-08-19 11:28:29.000000000 -0700 @@ -781,7 +781,7 @@ if (options.adm_forced_command) { original_command = command; command = options.adm_forced_command; - if

Folks, I noticed that whenever I scp'ed a file to my test server (running OpenSSH 2.1.0p2, and then tested with p3) it was created owned by root. /home/me $ ls -al .profile -rwx------ 1 me group 1056 Jan 18 1999 .profile /home/me $ scp .profile me at server:test me at server's password: .profile 100%

Here is a patch I just wrote and tested which may be of interest to those who wish to use KerberosGetAFSToken (currently requires Heimdal libkafs) in combination with GSSAPIDelegateCredentials. The patch is in the public domain and comes with no warranty whatsoever. Applies to pristine 3.8p1. Works for me on Solaris and Tru64. I'd probably have used Doug Engert's patch from 2004-01-30 if Heimdal's afslog command supported -setp...

Hi, We are planning on releasing the next version of OpenSSH in a couple of weeks. As always, we would like to see it tested as widely as possible before this happens. We would therefore like you to test the latest snapshots (20030122 and later) on as many machines that you have access to. Ideally this testing should include running the regress tests and use of the snapshots in a

...sshconnect.h ssh-dss.h sshlogin.h sshpty.h ssh-rsa.h sshtty.h tildexpand.h uidswap.h uuencode.h xmalloc.h] remove comments from .h, since they are cut&paste from the .c files and out of sync - dugsong at cvs.openbsd.org 2001/06/26 17:41:49 [servconf.c] #include <kafs.h> - markus at cvs.openbsd.org 2001/06/26 20:14:11 [key.c key.h ssh.c sshconnect1.c sshconnect2.c] add smartcard support to the client, too (now you can use both the agent and the client). - markus at cvs.openbsd.org 2001/06/27 02:12:54 [serverloop.c serverloop.h sessi...

...gt;short_block_lost_tot -= now - inf->sched_start_abs; - PRINT(3,"Domain %i.%i: Short_block_loss: %"PRIi64"\n", - inf->vcpu->domain->domain_id, inf->vcpu->vcpu_id, - inf->short_block_lost_tot); #if 0 - /* - * KAF: If we don''t exit short-blocking state at this point + /* KAF: If we don''t exit short-blocking state at this point * domain0 can steal all CPU for up to 10 seconds before * scheduling settles down (when competing against another * CPU-bound dom...