hi, i modified the /etc/pam.d/system-auth file ,but it did not work,how can i debug this error?Are there any other files that need to be modified?
root@test-afs002 cai]# vi /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_krb5.afs.so use_first_pass ignore_root auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_krb5.so account [default=bad success=ok user_unknown=ignore] pam_winbind.so cached_login account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_krb5afs.so use_authtok password sufficient pam_winbind.so cached_login use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_krb5afs.so ~ > -----原始邮件----- > 发件人: "Benjamin Kaduk" <ka...@mit.edu> > 发送时间: 2016-05-06 23:17:46 (星期五) > 收件人: zhaoxy...@ustc.edu.cn > 抄送: > 主题: Re: RE: [OpenAFS] ad+openafs > > You should keep the list cc'd for this thread; there are many other people > with more experience in this regardn than me. > > That said, it sounds like you want pam_krb5 and pam_afs_session on the > linux client, with some configuration knobs set accordingly. > > -Ben > > On Thu, 5 May 2016, zhaoxy...@ustc.edu.cn wrote: > > > > > hi， > > the system works now,but i want to get tokens when i login the linux > > system without input the kinit and aklog command,how can i achieve this > > goal?do i need to install some packages? > > > > sotfware configuration : ad(win 2008 server ) + nis+ openafs 1.6.14 > > > > > -----原始邮件----- > > > 发件人: "Benjamin Kaduk" <ka...@mit.edu> > > > 发送时间: 2016-05-04 13:44:00 (星期三) > > > 收件人: "Brandon Allbery" <ballb...@sinenomine.net> > > > 抄送: "zhaoxy...@ustc.edu.cn" <zhaoxy...@ustc.edu.cn>, > > > "openafs-info@openafs.org" <openafs-info@openafs.org> > > > 主题: RE: [OpenAFS] ad+openafs > > > > > > 1.6.14 doesn't need to have single-DES enabled; we shouldn't be > > > recommending it. The rxkad.keytab method should work fine with AES keys. > > > > > > -Ben > > > > > > On Tue, 3 May 2016, Brandon Allbery wrote: > > > > > > > -1765328370 is KRB5KDC_ERR_ETYPE_NOSUPP. This often means that DES is > > > > disabled somewhere. Note that the client library *also* needs DES > > > > enabled; you might need to add to the [libdefaults] section of > > > > /etc/krb5.conf on the RH system, > > > > > > > > allow_weak_crypto = true > > > > > > > > From: openafs-info-ad...@openafs.org > > > > [mailto:openafs-info-ad...@openafs.org] On Behalf Of > > > > zhaoxy...@ustc.edu.cn > > > > Sent: Tuesday, May 3, 2016 4:39 AM > > > > To: openafs-info@openafs.org > > > > Subject: [OpenAFS] ad+openafs > > > > > > > > > > > > hi > > > > > > > > i install openafs1.6.14 on redhat 6.7 and i want to use the ad as krb5 > > > > auth . > > > > > > > > here is my steps: > > > > > > > > 1 install openafs1.6.14 on redhat6.7 > > > > > > > > 2 install ad on windows 2008 r2 > > > > > > > > 3 ktpass -princ afs/cellname@ADDOMAINNAME -mapuser > > > > afscell@ADDOMAINNAME \ -mapOp add -out afs-keytab +rndPass -crypto > > > > DES-CBC-CRC +DesOnly \ -ptype KRB5_NT_PRINCIPAL +DumpSalt ) > > > > > > > > 4 use kinit wang > > > > > > > > aklog > > > > > > > > [root@test-afs002 ]# klist -e -f > > > > Ticket cache: FILE:/tmp/krb5cc_0 > > > > Default principal: w...@pc.com<mailto:w...@pc.com> > > > > > > > > Valid starting Expires Service principal > > > > 05/03/16 16:26:46 05/04/16 02:26:33 > > > > krbtgt/pc....@pc.com<mailto:krbtgt/pc....@pc.com> > > > > renew until 05/10/16 16:26:46, Flags: FRIA > > > > Etype (skey, tkt): aes256-cts-hmac-sha1-96, > > > > aes256-cts-hmac-sha1-96 > > > > 05/03/16 16:27:04 05/04/16 02:26:33 > > > > afs/pc....@pc.com<mailto:afs/pc....@pc.com> > > > > renew until 05/10/16 16:26:46, Flags: FRA > > > > Etype (skey, tkt): arcfour-hmac, arcfour-hmac > > > > [root@test-afs002 ]# ls /afs/pc.com/ > > > > ls: cannot open directory /afs/pc.com/: Permission denied > > > > [root@test-afs002 ]# > > > > > > > > if Create a afs user in the AD as a normal user with the login afs, set > > > > user cannot change passwordd, password never expires. Try to set "Use > > > > Kerberos DES encryption types for this account" on the Account tab. > > > > then when i use the command > > > > > > > > [root@test-afs002 ]# kinit wang > > > > Password for w...@pc.com<mailto:w...@pc.com>: > > > > [root@test-afs002 ]# aklog > > > > aklog: Couldn't get pc.com AFS tickets: > > > > aklog: unknown RPC error (-1765328370) while getting AFS tickets > > > > [root@test-afs002 ]# > > > > > > > > i configure the ad follow the web > > > > https://wiki.openafs.org/win2008r2adaskdc/,but i can't find what is > > > > wrong with me ?can you tell me ? > > > > > > > > thanks > > > > > > > > > > > > > >
