search for: pam_krb4

...#39;'s shell. This means that a PAM module which expects to be able to do post-session cleanup in its pam_close_session hook will do the cleanup *before* the user''s shell is invoked. This breaks the pam_linux_afs module (which invokes AFS''s unlog) and KTH Kerberos''s pam_krb4 module (which destroys the ticket cache), among others, so the session is effectively unauthenticated (contrary to both PAM documentation and users'' and administrators'' expectations). The workaround for pam_linux_afs is to remove the session entry for pam_linux_afs from /etc/pam....

Hello all, I'd greatly appreciate a patch that will stop PAM mucking around after I log in with a Kerberos 4 ticket and forward an AFS ticket (KTH Kerberos 1.1.1 used for libkrb/libkafs). The trouble is, I need pam_krb4, so that folks, who log in with without tickets using tunnelled plaintext password, would get Kerberos 4 tickets for the box. I rebuilt sshd without PAM in order to verify that PAM destroys the tokens but I've not enough time to analyse the code in more details. I guess # ifdef USE_PAM do_p...

...execs the user's shell. This means that a PAM module which expects to be able to do post-session cleanup in its pam_close_session hook will do the cleanup *before* the user's shell is invoked. This breaks the pam_linux_afs module (which invokes AFS's unlog) and KTH Kerberos's pam_krb4 module (which destroys the ticket cache), among others, so the session is effectively unauthenticated (contrary to both PAM documentation and users' and administrators' expectations). The workaround for pam_linux_afs is to remove the session entry for pam_linux_afs from /etc/pam.d/login...