Hi folks,
How should k5start (kstart 4.1-2 on Debian wheezy) be configured for
/etc/inittab to maintain a Kerberos ticket *and* an AFS token for an
arbitrary server process not running as root?
The -t option seems to do nothing for me, while any command option
placed at the end of the statement only causes another problem that
makes init disable the process after respawning too quickly.
For example:
KQ:2345:respawn:/usr/bin/k5start -U -f /etc/zz.keytab -K 10 -l 24h \
-k /tmp/krb5cc_99 -o zz -t
A Kerberos TGT is created for the zz user (ID 99) along with an AFS
service ticket, but no AFS token appears. However, if I run 'sudo -u
zz aklog' afterwards, the AFS token is created without any problem.
~# k5start -U -f /etc/zz.keytab -k /tmp/krb5cc_99 -o zz -t
A manual test that yields the same result.
~# KINIT_PROG=/usr/bin/aklog ; k5start -U -f /etc/krb5-minidlna.keytab \
-k /tmp/krb5cc_107 -o minidlna -t
Again, same result (just in case k5start was attempting to start aklog
from the wrong location).
~# k5start -U -f /etc/zz.keytab -k /tmp/krb5cc_107 \
-o minidlna /root/ma
Here, -t is replaced by a command, /root/ma, a shell script with a
single line: '/usr/bin/sudo -u zz /usr/bin/aklog'. This actually
works, producing a Kerberos TGT, an AFS service ticket and an AFS
token. But, all attempts to use this use in /etc/inittab have resulted
in fast respawns followed by init disabling it.
Any idea what I'm doing wrong?
Thanks,
Jaap
_______________________________________________
OpenAFS-info mailing list
[email protected]
https://lists.openafs.org/mailman/listinfo/openafs-info
