A few more comments in reference to the pam_afs in 1997, no aklog and fork/exec.
We first developed ak5log in July 1996, when we where using DCE as the Kerberos KDCs. DCE did not support k4 so everything had to be done via K5, and krb524. Ak5log was (and still is) fork/exec'ed by rlogind, telnetd, ftpd, login and now even sshd.
See the announcement texst file at: ftp://achilles.ctd.anl.gov/pub/kerberos.v5/old/Anouncment.k56
...
The intent of the original note was to get OpenAFS to add missing pieces such as pam_afs or pam_afs2 and make it easier to add the "aklog" supplied by OpenAFS or a Kerberos developer or by a site when not available from the above.
Derrick J Brashear wrote:
On Wed, 13 Apr 2005, Douglas E. Engert wrote:
pam_afs2.c will then call the gafstoken routine that will get a PAG using syscalls, then fork/exec your favorite aklog, ak5log, gssklog, or afslog to actually get the token.
Ask Ken Hornstein about my mockery of forking aklog. Anyway,
Basically, you're doing the same thing as pam_openafs_session.so in debian.
Could be, but its for more then debian. I would like to see OpenAFS provide the PAM routine that would run in any system.
We don't provide aklog, afslog, ak5log, gssklog or fries with that yet, so basically we'd be providing "hey buddy, wanna fork /bin/true?"
pam_afs2 in not doing authentication, it is there to get a PAG and token using the credentials saved by a previous pam or by the application like OpenSSH.
I wrote that in like 1997, it was called pam_afs, used the kerberos tickets gotten by pam_krb4, and linked libraries instead of forking;-)
_______________________________________________ OpenAFS-info mailing list [email protected] https://lists.openafs.org/mailman/listinfo/openafs-info
--
Douglas E. Engert <[EMAIL PROTECTED]> Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 _______________________________________________ OpenAFS-info mailing list [email protected] https://lists.openafs.org/mailman/listinfo/openafs-info
