[27633] in Kerberos
Re: FYI: Kerberos on RHEL5
daemon@ATHENA.MIT.EDU (Russ Allbery)
Fri Apr 6 14:47:12 2007
From: Russ Allbery <rra@stanford.edu>
To: "Edgecombe, Jason" <jwedgeco@uncc.edu>
In-Reply-To: <A01ABA2A211C644596549C5FF91C50E413991C6A@EXEVS02.its.uncc.edu>
(Jason Edgecombe's message of "Fri, 6 Apr 2007 14:02:32 -0400")
Date: Fri, 06 Apr 2007 11:46:55 -0700
Message-ID: <87slbdtk68.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Edgecombe, Jason <jwedgeco@uncc.edu> writes:
> This is a heads-up for anyone using kerberos on RedHat Enterprise Linux
> 5.
> I just solved a problem that's been a royal pain for me.
> I had console and gdm logins working fine for RHEL5 and I got kerberos
> single-signon working for ssh, but I had trouble getting password
> authenticaio working. It would accept my kerberos password, but I would
> have any tickets or tokens.
> To solve my problem, I had to enable the use_shmem option in
> /etc/krb5.conf. for use with sshd.
This is because the Red Hat PAM module tries to use PAM data to pass
information between the auth module and the session module, which OpenSSH
breaks due to its weird PAM handling.
If you use:
<http://www.eyrie.org/~eagle/software/pam-krb5/>
you shouldn't have this problem and you shouldn't have to use shared
memory hacks to work around it. (I personally would rather use a
temporary file cache than a shared memory cache because it's a hell of a
lot easier to debug when something goes wrong. But mileage may vary.)
I'm always interested in any shortcomings of my module that has people
still using other PAM modules for reasons other than "I want to use the
one that comes with the OS" and will try to fix them as I have time.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
