Hello
I am trying to set up a 1.4.10 client on RHEL 5 so that it talks to an old
1.2 server and I can aklog to get tickets, but I can't seem to get afk tokens
on login. I expect that I have not set up pam correctly for kerberos 5/4
issues, but am a bit worried that there are issues with talking to such an old
afs server.
When logging in, pam throws the following error...
afs: Tokens for user of AFS id 3555 for cell csic.umd.edu are discarded
(rxkad errror=19270407)
translate_et 19270407
19270407 (rxk).7 = security object was passed a bad ticket
I get the following tickets...
$ klist -e
Ticket cache: FILE:/tmp/krb5cc_3555_KwoBNN
Default principal: [email protected]
Valid starting Expires Service principal
08/11/09 18:16:29 08/12/09 04:16:29 krbtgt/[email protected]
renew until 08/11/09 18:16:29, Etype (skey, tkt): DES cbc mode with
CRC-32, Triple DES cbc mode with HMAC/sha1
Kerberos 4 ticket cache: /tmp/tkt3555_9S2HNQ
Principal: [email protected]
Issued Expires Principal
08/11/09 18:16:29 08/12/09 04:16:29 [email protected]
I can aklog to get afs tickets once logged in and then I have proper AFS
tokens with permission to access the 1.2 afs server...
[geo...@invincible /]$ aklog -d
Authenticating to cell csic.umd.edu (server queasy-int.csic.umd.edu).
Trying to authenticate to user's realm CSIC.UMD.EDU.
Getting tickets: afs/[email protected]
Using Kerberos V5 ticket natively
About to resolve name geoffr to id in cell csic.umd.edu.
Id 3555
Set username to AFS ID 3555
Setting tokens. AFS ID 3555 / @ CSIC.UMD.EDU
[geo...@invincible /]$ klist -e
Ticket cache: FILE:/tmp/krb5cc_3555_KwoBNN
Default principal: [email protected]
Valid starting Expires Service principal
08/11/09 18:16:29 08/12/09 04:16:29 krbtgt/[email protected]
renew until 08/11/09 18:16:29, Etype (skey, tkt): DES cbc mode with
CRC-32, Triple DES cbc mode with HMAC/sha1
08/11/09 18:18:32 08/12/09 04:16:29 afs/[email protected]
renew until 08/11/09 18:16:29, Etype (skey, tkt): DES cbc mode with
CRC-32, DES cbc mode with CRC-32
Kerberos 4 ticket cache: /tmp/tkt3555_9S2HNQ
Principal: [email protected]
Issued Expires Principal
08/11/09 18:16:29 08/12/09 04:16:29 [email protected]
I have played with different options, but currently have...
auth sufficient pam_krb5afs.so debug use_first_pass tokens=true
krb4_convert=true
in /etc/pam.d/system-auth. /etc/krb5.conf contains...
[appdefaults]
pam = {
debug = true
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = true
krb4_convert_524 = true
krb4_use_as_req = true
addressless = true
afs_cells = csic.umd.edu
}
Can anyone suggest what the problem might be or point me at some good
documentation on pam/afs/krb that might help?
I just saw that 1.4.11 has come out since I last downloaded openafs and will
be trying it out. I have not had a chance to look over the changes to see if
anything that might have affected my situation has changed.
Thanks for any help or suggestions.
-Geoff
_______________________________________________
OpenAFS-info mailing list
[email protected]
https://lists.openafs.org/mailman/listinfo/openafs-info
