[27772] in Kerberos
Re: pam_krb5: unable to get PAM_KRB5CCNAME,
daemon@ATHENA.MIT.EDU (Russ Allbery)
Mon May 14 16:05:27 2007
From: Russ Allbery <rra@stanford.edu>
To: kerberos@mit.edu
In-Reply-To: <x3hcqg1b6w.fsf@nowhere.com> (Adam Megacz's message of "Sun, 13
May 2007 17:49:27 -0700")
Date: Mon, 14 May 2007 13:05:14 -0700
Message-ID: <877irbcgsl.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Adam Megacz <megacz@cs.berkeley.edu> writes:
> Can anybody tell me what this message means, and how to fix the problem
> it appears to indicate?
> May 13 17:46:52 goliath sshd[6468]: (pam_krb5): root: unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
It means that the pam_krb5 auth stack either never ran or failed, and
therefore setcred and open_session will be skipped. pam_krb5 only does
ticket cache setup if pam_krb5 was the one doing the authentication.
If you're doing GSSAPI authentication to sshd, this is normal, since sshd
does ticket cache setup itself in that case and pam_krb5 doesn't need to
do anything.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
