similar to: OpenSSH, OpenAFS, Heimdal Kerberos and MIT Kerberos

Would OpenSSH be willing to accept a modification similar to the one below to replace the kafs modification to get an AFS PAG and token? The nice features of this are that it can be compiled in even if OpenAFS is not available. At runtime if the dynamic library is present, it can be loaded and called. A dynamic lib is used so the setpag is in the same process. It has been reported that the

Here is a patch I just wrote and tested which may be of interest to those who wish to use KerberosGetAFSToken (currently requires Heimdal libkafs) in combination with GSSAPIDelegateCredentials. The patch is in the public domain and comes with no warranty whatsoever. Applies to pristine 3.8p1. Works for me on Solaris and Tru64. I'd probably have used Doug Engert's patch from 2004-01-30 if

We start to use centos 5 for our workstation at our site (University Innsbruck) and we use openafs to hold the home directories. There would be a big advantage to have the openafs kernel module (and the additional rpms) in the centos extras (or addons) repository with an automatic compile for the available kernels. If you need any help to do this i would be happy to participate in any way.

Hi everyone, I just upgraded to 5.6 and keep on getting the following error message: [root at rwjafs1 ~]# yum update Loaded plugins: fastestmirror, priorities Loading mirror speeds from cached hostfile * base: centos.mirror.nac.net * extras: mirror.batblue.com * updates: mirror.atlanticmetro.net Setting up Update Process Resolving Dependencies --> Running transaction check ---> Package

Hi All. OpenSSH is getting ready for a release soon, so we are asking for all interested parties to test a snapshot. Changes include: * sshd will now re-exec itself for each new connection (the "-e" option is required when running sshd in debug mode). * PAM password authentication has been (re)added. * Interface improvements to sftp(1) * Many bug fixes and improvements, for

Hi All, The OpenBSD tree is likely to be dropping KerberosIV support very soon. We will ultimately follow suit, but if there are many Krb4 users we may give a transition period of a release or two. AFAIK we don't compile at all against MIT KrbIV because of library conflicts. So, who is using OpenSSH Krb4 support at the moment? -d

Hi all! Just wondering whether anybody has any idea on configuration for accessing AFS volume using current version of Samba. The issue is how to get Samba pass correct kerberos ticket on opening the AFS volume. Having Samba to have root access over AFS is not an option as we need the AFS permission to still apply. Upon searching, the most recent info I can get is this thread from OpenAFS

From: Lamar Owen <lowen at pari.edu> > Referencing SL3 and CentOS 3 (as I haven't run SL4 as yet) there were some > scientific applications and some Java stuff, eclipse for one, You do understand the redistribution issues with Java, correct? It's a Sun problem (a typical thorn for Red Hat in general), not a Red Hat one. > part of cluster suite for another, included. >

Howdy list, Sorry if this is a frequently discussed topic, or an off-topic question, but I couldn't find much info about my question by performing quick searches in the archives, and my question is pretty tightly related to security... Background: =========== I have a number of FreeBSD machines. Most are 4.x, but a few are 5.x (mainly the testing/devel machines). I also have a single Red

Greetings, I'm working on the infrastructure of a medium size client/server environment using an Active Directory running on Windows Server 2003 for central authentication of users on linux clients. Additionally OpenAFS is running using Kerberos authentication through Active Directory as well. Now I want to grant users remote access to their AFS data by logging in into a central OpenSSH

Redudancy and recovering from a mailstore failure is one of the concerns I am trying to address where I work. Any plans to have Dovecot store emails in a database? NAS/SAN devices which do automatic replication to a second device are extremely expensive. I also don't see any distributed filesystem which is mature and available for the OS we use (FreeBSD). I recall at one point, many

I took Markus Friedl's advice and set up a KbdintDevice for Kerberos password authentication/expiry. It took me a bit to wrap my head around privsep, but I think it's working properly (code stolen shamelessly from FBSD's PAM implementation :->). The hardest part was working out how to get the interaction between krb5_get_init_creds_password() (along with the prompter) to work

Hi! I've noticed that openssh always does a do_setpag() if compiled with AFS-support no matter which authentication method is used. Maybe I'm missing something but shouldn't it only get a pag, if AFS-token-passing is used? If password authentication is used, an AFS-pam-module (or the authenticate function on AIX) will do the job, otherwise, no token can be obtained and therefore no

From: Johnny Hughes <mailing-lists at hughesjr.com> > Nope ... I can't build that with GNU gcc and against GNU glibc and > release it ... sorry, no OpenAFS :( ??? Actually, you _can_. You just can't link it into the GPL kernel program. [ I'm not posting this to cross you. But someone correct me if I'm wrong. ] There is nothing in the GPL that prevents a GPL

Okay I don't think what I want to do is possible but here goes. I want to deploy a samba domain for my windows clients, but I want samba to use AFS on the back end. But AFS requires kerberos to get tickets and tokens. So is there anyway to make this work. I personally don't care if samba accepts kerberos tickets from the client or not, but a ticket and AFS token will need to be

Hi, I?m trying to develop a PAM module with OpenSSH, and I realized I need to retrieve something in a later stage that was saved in another previous stage. As far as my tests on OpenSSH 7.6 go, the password auth route goes through PAM auth, account, session, and the session stage is in a different UNIX process from the process where auth and account take place. For the key auth route, auth stage

http://bugzilla.mindrot.org/show_bug.cgi?id=717 Summary: AFS tokens are not generated upon login Product: Portable OpenSSH Version: -current Platform: UltraSparc OS/Version: Solaris Status: NEW Severity: normal Priority: P2 Component: PAM support AssignedTo: openssh-bugs at mindrot.org

Hello, i'm currently trying to find a way to integrate a openafs cell and samba (without plaintext passwords). this should all be possible with a windows kdc, giving out afs tickets and forward these tickets to the samba server. unfortuntely this is not an option here. is there a way to connect samba 3.x to a mit krb5 server ? Holger Brueckner net-labs Systemhaus GmbH

Hello all, After setting up a Solaris 10 machine with ZFS as the new NFS server, I''m stumped by some serious performance problems. Here are the (admittedly long) details (also noted at http://www.netmeister.org/blog/): The machine in question is a dual-amd64 box with 2GB RAM and two broadcom gigabit NICs. The OS is Solaris 10 6/06 and the filesystem consists of a single zpool stripe

Hi all. I'm using a CentOS 6.8 VM to do volunteer builds for an open source project. I want to build Pale Moon with a gtk2 library older than 2.24, to allow people with older linuxes to run it. Short summary, if built against version gtk2-2.24 and/or higher, the binary will use a function that does not exist in gtk2-2.23 and lower. Net result is that the program dies with an