--On Wednesday, August 24, 2005 6:10 PM -0400 "Ron Croonenberg"
<[EMAIL PROTECTED]> wrote:
Uhm, ok, someone else suggested to not do any "pam" stuff.. that way
afs = users can simply not use the machine.
I thought that maybe there was some "elegant" way to do what I wanted.
Ron,
I may be missing something, but if you install the afs client, but don't
put an afs hook in the pam configuration for the sshd, only users with
local accounts will be able to login, and that won't open that machine to
afs users. Pam can use a variety of sources for authentication, and you
should use it, it's a Good Thing.
You can also set up pam for so that it requires a local login, and also
logs into the afs cell, but doesn't allow users who just authenticate via
afs to connect. This is how my workstation is set up--that way only local
accounts can log in, but anyone who does gets a token to afs when they do
and doesn't have to klog.
Also, you can use the sshd configuration to specifically limit who can
login with ssh in any case, or force ssh logins to require a key (instead
of using a password). So you could allow yourself, but disallow all others
as an additional precaution.
Hope that helps,
bil
--
________________________
bil hays
Network Manager
Computer Science, UNC CH
_______________________________________________
OpenAFS-info mailing list
[email protected]
https://lists.openafs.org/mailman/listinfo/openafs-info
