similar to: [Bug 326] Bug in AFS token forwarding

There is a bug in the code for getting AFS tokens in function send_afs_tokens() in sshconnect1.c Here is how the bug manifests itself: If I have an AFS token that is still valid _and_ one that was valid but is now expired then AFS token forwarding ignores both tokens instead of forwarding the still valid one. I can reproduce this problem on Red Hat Linux 7.2 systems with OpenSSH-3.4p1 (and

http://bugzilla.mindrot.org/show_bug.cgi?id=326 Summary: Bug in AFS token forwarding Product: Portable OpenSSH Version: -current Platform: ix86 OS/Version: Linux Status: NEW Severity: normal Priority: P4 Component: ssh AssignedTo: openssh-unix-dev at mindrot.org ReportedBy: alfw at

http://bugzilla.mindrot.org/show_bug.cgi?id=324 ------- Additional Comments From jan.iven at cern.ch 2002-06-30 09:19 ------- Created an attachment (id=125) KRB4/KRB5/AFS with privsep ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=324 Summary: privsep break KRB4 auth, KRB4 TGT forwarding and AFS token forwarding Product: Portable OpenSSH Version: -current Platform: All OS/Version: All Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo:

Hello, I came across an interoperability problem in OpenSSH 3.0p1 and 3.0.1p1 concerning the AFS token forwarding. That means that the new versions are not able to exchange AFS tokens (and Kerberos TGTs) with older OpenSSH releases (including 2.9p2) and with the old SSH 1.2.2x. In my opinion this problem already existed in Openssh 2.9.9p1, but I have never used this version (I only looked at the

http://bugzilla.mindrot.org/show_bug.cgi?id=717 Summary: AFS tokens are not generated upon login Product: Portable OpenSSH Version: -current Platform: UltraSparc OS/Version: Solaris Status: NEW Severity: normal Priority: P2 Component: PAM support AssignedTo: openssh-bugs at mindrot.org

Here is a patch I just wrote and tested which may be of interest to those who wish to use KerberosGetAFSToken (currently requires Heimdal libkafs) in combination with GSSAPIDelegateCredentials. The patch is in the public domain and comes with no warranty whatsoever. Applies to pristine 3.8p1. Works for me on Solaris and Tru64. I'd probably have used Doug Engert's patch from 2004-01-30 if

These Scripts at location /afs/rrz.uni-koeln.de/wsadmin/contrib/ : Init-ssh2 krb5gettoken xauthrc ssh2 enable credential (krb5 ticket) passing and get you a PAG and AFS token on subsequent login. This should work with any ssh. NO patches. Enjoy & send bugs/cents to: Laatsch at Uni-Koeln.DE Best regards Rainer Laatsch

Hi I was finally able to build openssh with afs support using the kth-kerberos libraries. I cannot get the token passing to work. I think I am missing something fundamental in setting this up but I can't seem to find any documentation. I would geatly appreciate any advice offered. _________________________________________________________________ Gedaliah Wolosh, Ph.D. 973 596-5437 New

http://bugzilla.mindrot.org/show_bug.cgi?id=508 Summary: Krb4/AFS token passing doesn't work because of mkstemp Product: Portable OpenSSH Version: -current Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo: openssh-unix-dev at mindrot.org

Full_Name: Jeremy Fox Version: 1.5.0 OS: Solaris 8, 64 bit Submission from: (NULL) (171.64.232.63) I am compiling R under Solaris and the compilation stops at this point. The problem only happens when I link in readline. The R binary is actually compiled and readlne works. The main problem with the compiled binary (other than that all the supporting files were not correctly installed) is that

Hello, I going to use ssh with Kerberos V5 support along with support for AFS. I don't want to use Kerberos V4 or AFS token passing. The only thing I need from AFS is creating an AFS token (using appropriate function from krb5 API) after user's authentication. It seems to me that such scenario is not much supported by the current code. Rather it is assumed only Kerberos 4 will be used

Hi! I've noticed that openssh always does a do_setpag() if compiled with AFS-support no matter which authentication method is used. Maybe I'm missing something but shouldn't it only get a pag, if AFS-token-passing is used? If password authentication is used, an AFS-pam-module (or the authenticate function on AIX) will do the job, otherwise, no token can be obtained and therefore no

I think I have come across what seems to be a bug in the interplay between Samba and AFS. I'm running 1.9.16p11 on an IBM RS/6000 (AIX 4.1.5) with the AFS support included (AFS 3.4a). The client machine is running Windows 95. I've created an AFS area which is writeable (rlidwk) to an AFS protection group. The group contains two AFS users, say user1 and user2. If user1 creates a file in

The native authentication methods of openssh are (not counting insecure RhostsRSAAuthentication) 1) public key 2) password For users with home dirs in AFS space, method 1) does not work. Except with (non foolproof) fiddling on the access controls within the home directory. This might lead to security issues when done by inexperienced users. Without some work, only 2) remains. Being forced to send

For some reasons the afs tokenforwarding stuff has changed siginificantly from v 2.9p2 to 2.9.9p2. This makes it impossible to use public key authenticication in a standart AFS environment. I don't know the reasons for these changes. In any case attached is a patch which restores the old behaviour. Regards Serge -- Serge Droz Paul Scherrer Institut mailto:serge.droz at

Hello, currently we are storing the incoming mail in the user's home directory, which is within a distributed filesystem called AFS (OpenAFS). Accessing the "mbox" file directly (using the distributed filesystem) works fine with mutt, thunderbird, ... To access the INBOX from a machine, which does not have access to this distributed filesystem, we are using IMAP (UW-imap). Now I

Dear All, ? I have found differences between glmnet versions 1.7 and 1.7.1 which, in my opinion, are not cosmetic and do not appear in the ChangeLog. If I am not mistaken, glmnet appears to return different number of selected input variables, i.e. nonzeroCoef(fit$beta[[1]]) differes between versions. The code below is the same for 1.7.1 and 1.7, but you can see that outputs differ. I would

Hi All, The OpenBSD tree is likely to be dropping KerberosIV support very soon. We will ultimately follow suit, but if there are many Krb4 users we may give a transition period of a release or two. AFAIK we don't compile at all against MIT KrbIV because of library conflicts. So, who is using OpenSSH Krb4 support at the moment? -d

With the help of Jan Iven I have been able to compile openssh-2.9.9p2 on Solaris 2.6 with AFS/kerb4 support using gcc. ./configure --sysconfdir=/etc/ssh --with-tcp-wrappers \ --with-egd-pool=/var/run/egd-pool \ --with-kerberos4=/usr/athena --with-afs=/usr/afsws to do this I modified the resulting Makefile, from: CPPFLAGS=-I. -I$(srcdir) -I/usr/local/ssl/include