Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-10-01 Thread Phillip Moore
That makes a lot of sense to me. The guide is already VERY complicated, and adding unnecessary options, and yet another decision the user has to research doesn't make anything easier. Derrick also pointed out that openafs-krb5 includes aklog as well, which you need later in the process, so in

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Jeff Blaine
Maybe this (kind of old info, but who knows) ? http://www.openafs.org/pipermail/openafs-info/2004-September/014929.html On 9/30/2010 7:56 AM, Phillip Moore wrote: pts: Permission denied ___ OpenAFS-info mailing list OpenAFS-info@openafs.org

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Derrick Brashear
On Thu, Sep 30, 2010 at 7:56 AM, Phillip Moore w.phillip.mo...@gmail.com wrote: My quest to refresh my AFS knowledge continues, with mixed results. I can get as far as rebooting the first AFS machine, and the server and client seems to come up fine, and talk to each other.  I can run any

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Phillip Moore
THAT is the missing peice!! I thought there was something missing to deal with the name mapping, and that's it. I'll be sure to document this in the Quick Start Guide patch. On Thu, Sep 30, 2010 at 8:07 AM, Jeff Blaine jbla...@kickflop.net wrote: Maybe this (kind of old info, but who knows) ?

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Phillip Moore
The Kerberos version is 1.6.1: [r...@fhcore ~]# rpm -q -a | grep ^krb5 krb5-server-1.6.1-36.el5_5.5 krb5-libs-1.6.1-36.el5_5.5 krb5-workstation-1.6.1-36.el5_5.5 krb5-libs-1.6.1-36.el5_5.5 I'm staying away form the bleeding edge releases, until I've re-learned how to make all this work with the

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Harald Barth
I usually create the AFS principal and put it onto the first server in one go with heimdals ktutil: ktutil -k AFSKEYFILE:/usr/afs/etc/KeyFile get -p your-admin-principal afs/your-c...@your-realm The AFSKEYFILE: tells the heimdal library that this is not a normal krb5 keyfile. (This is from

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Phillip Moore
This is good to know. Does it seem reasonable to document this as an alternative to using asetkey for sites that use Heimdal? If so, I'll include this in the Quick Start Guide patch (which, after all these promises, I had better submit if I am to regain any credibility here) On Thu, Sep

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Russ Allbery
Phillip Moore w.phillip.mo...@gmail.com writes: This is good to know. Does it seem reasonable to document this as an alternative to using asetkey for sites that use Heimdal? Yes. People using Heimdal should probably not be using asetkey. -- Russ Allbery (r...@stanford.edu)

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Phillip Moore
If that's the case, then do Heimdal users need to bother with the openafs-krb5 rpm at all? I should point out that while I have already promised to *update* the QSG, it can't be *fixed* without a lot more ongoing work (and I'm sure this is obvious to everyone else). I'm merely updating the

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Russ Allbery
Phillip Moore w.phillip.mo...@gmail.com writes: If that's the case, then do Heimdal users need to bother with the openafs-krb5 rpm at all? Probably not. Although there's a lot of software that assumes you have an aklog, so making a symlink from aklog to afslog is probably useful. :) I

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Derrick Brashear
On Thu, Sep 30, 2010 at 6:05 PM, Russ Allbery r...@stanford.edu wrote: Phillip Moore w.phillip.mo...@gmail.com writes: If that's the case, then do Heimdal users need to bother with the openafs-krb5 rpm at all? Probably not.  Although there's a lot of software that assumes you have an aklog,

Re: [OpenAFS] Quick Start Kerberos problem: can acquire tokens, but they don't work

2010-09-30 Thread Brandon S Allbery KF8NH
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 9/30/10 17:58 , Phillip Moore wrote: If that's the case, then do Heimdal users need to bother with the openafs-krb5 rpm at all? If this is going into a quick start guide, I would be tempted to say that because asetkey will work with Heimdal