similar to: OPenAFS and OpenSSH replacing kafs

Rather then implementing kafs in MIT Kerberos, I would like to suggest an alternative which has advantages to all parties. The OpenSSH sshd needs to do two things: (1) sets a PAG in the kernel, (2) obtains an AFS token storing it in the kernel. It can use the Kerberos credentials either obtained via GSSAPI delegation, PAM or other kerberos login code in the sshd. The above two

Here is a patch I just wrote and tested which may be of interest to those who wish to use KerberosGetAFSToken (currently requires Heimdal libkafs) in combination with GSSAPIDelegateCredentials. The patch is in the public domain and comes with no warranty whatsoever. Applies to pristine 3.8p1. Works for me on Solaris and Tru64. I'd probably have used Doug Engert's patch from 2004-01-30 if

Hi, We are trying to compile OpenSSH with AFS support to enable password-less login in a linux cluster. We are getting the error mentioned at the bottom of this mail. Also, included the information of other packages and the options used with configure. Please help us to sort out this issue. Server is running on RedHat Linux v7.3 OpenAFS Information Downloaded from

(I think the subject is quite descriptive; however for use-cases and details see bellow after the mention of the old conversation and the patch.) Searching the mailing list about this topic yields an old conversation about this from 2008: * https://lists.samba.org/archive/rsync/2008-November/022148.html * https://lists.samba.org/archive/rsync/2008-November/022150.html I'll quote

Which version of openafs do I need to compile AFS support into samba. I tried compiling Samba 3.0.7 but get a setpag() undefined error, when building against OpenAFS 1.2.11. Thanks, Derek Isn't sanity just a one-trick pony anyway? I mean, all you get is that one trick, rational thinking, but when you're good and crazy, well, the sky's the limit! "The Tick (comic book)"

I'm trying to build the --with-fake-kaserver option in 3.0.4 on RHEL 3.0. I'm using the srpms provided on the samba.org site (http://us3.samba.org/samba/ftp/bin-pkgs/RedHat/SRPMS/samba-3.0.4 -1.src.rpm). My OpenAFS version is 1.2.11, rpms (openafs-1.2.11 and openafs-devel-1.2.11) provided from openafs.org. It compiles fine if I omit the --with-fake-kaserver configure option.

We start to use centos 5 for our workstation at our site (University Innsbruck) and we use openafs to hold the home directories. There would be a big advantage to have the openafs kernel module (and the additional rpms) in the centos extras (or addons) repository with an automatic compile for the available kernels. If you need any help to do this i would be happy to participate in any way.

1/ When I access with GSSAPIAuthentication & GSSAPIDelegateCredentials the option KerberosGetAFSToken does not work. The tickets are transfered correctly because the AFS tokens are obtained if the command afslog is inserted in /etc/ssh/sshrc file. 2/ When multiple realms are defined in /etc/krb5.conf sshd uses only the first default realm for kerberos password authentication. However gssapi

Sorry for the cross post, but I can't find the original mail I don't know if it was sent to the OpenAFS or the Samba list... I've managed to fix some compilation/build problems when using '--with-afs' to Samba. Something about undefined attributes: ----- s n i p ----- Linking bin/smbd lib/afs.o: In function `afs_createtoken':

I?ve stumbled across a rather obscure problem with ssh. My machine is setup to use Kerberos authentication, i.e., I use the pam_krb5 module in the ssh auth section of the PAM configuration file and I have sshd compiled to accept valid Kerberos 5 tickets as well. I also use OpenAFS, so I?ve got the pam_openafs_session module in the ssh session section of the PAM configuration file. Everything

Okay I don't think what I want to do is possible but here goes. I want to deploy a samba domain for my windows clients, but I want samba to use AFS on the back end. But AFS requires kerberos to get tickets and tokens. So is there anyway to make this work. I personally don't care if samba accepts kerberos tickets from the client or not, but a ticket and AFS token will need to be

Hi All. OpenSSH is getting ready for a release soon, so we are asking for all interested parties to test a snapshot. Changes include: * sshd will now re-exec itself for each new connection (the "-e" option is required when running sshd in debug mode). * PAM password authentication has been (re)added. * Interface improvements to sftp(1) * Many bug fixes and improvements, for

Hi everyone, I just upgraded to 5.6 and keep on getting the following error message: [root at rwjafs1 ~]# yum update Loaded plugins: fastestmirror, priorities Loading mirror speeds from cached hostfile * base: centos.mirror.nac.net * extras: mirror.batblue.com * updates: mirror.atlanticmetro.net Setting up Update Process Resolving Dependencies --> Running transaction check ---> Package

As posted, here is an updated patch which allows openssh to be built with non-selinux config. (Hi openssh guys, forwarding this to you incase you interested including it into the devel version of openssh. Please let us know if you have any suggestions or changes that need to be made) Regards Nigel Kukard On Thu, Sep 02, 2004 at 04:11:54PM -0400, Daniel J Walsh wrote: > New SSH patch. >

Jan, maybe I should check the /afs information that you pointed me at in a subsequent email first, but I wanted to update you on what happened following this path: I did get some mileage out of both of your suggestions below, but still did not make it through (now working with openssh-2.9p2): gcc -o ssh ssh.o sshconnect.o sshconnect1.o sshconnect2.o sshtty.o readconf.o clientloop.o -L.

I want up-to-dateish versions of TexLive, R, gnumeric, emacs, but on a more-or-less stable base of Centos-5.2. I asked for packages in this, but got no answers. So now I've built them and will let you try them if you want. I used the source packages from Fedora 8 and 9. I wanted TexLive because many of us have jumped ship to Ubuntu Linux 8.04 and it does offer TexLive, and the compatability

FYI, During my bi-weekly yum update, I noted the following warnings. Warnings during kernel update kernel-2.6.9-22.0.1.106.unsupported WARNING: /lib/modules/2.6.9-22.0.1.106.unsupported/kernel/fs/afs/kafs.ko needs unknown symbol afs_key_unregister WARNING: /lib/modules/2.6.9-22.0.1.106.unsupported/kernel/fs/afs/kafs.ko needs unknown symbol afs_key_register Is this anything to worry about? If I

From: Johnny Hughes <mailing-lists at hughesjr.com> > Nope ... I can't build that with GNU gcc and against GNU glibc and > release it ... sorry, no OpenAFS :( ??? Actually, you _can_. You just can't link it into the GPL kernel program. [ I'm not posting this to cross you. But someone correct me if I'm wrong. ] There is nothing in the GPL that prevents a GPL

-- | Damien Miller <djm at mindrot.org> \ ``E-mail attachments are the poor man's | http://www.mindrot.org / distributed filesystem'' - Dan Geer ---------- Forwarded message ---------- Date: Tue, 6 Mar 2001 22:28:52 +0100 (MET) From: "[iso-8859-2] Martin MOKREJ?" <mmokrejs at natur.cuni.cz> To: openssh at openssh.com Subject: Re: Problem compiling

Hi all! Just wondering whether anybody has any idea on configuration for accessing AFS volume using current version of Samba. The issue is how to get Samba pass correct kerberos ticket on opening the AFS volume. Having Samba to have root access over AFS is not an option as we need the AFS permission to still apply. Upon searching, the most recent info I can get is this thread from OpenAFS