[an error occurred while processing this directive]

SSH Patch Repository

AFS/Kerberos 5

Description:
This is a patch that was added so you can get an AFS token when a kerberos ticket is passed or kerberos password authentication is used.

Configure options added:

AKLOG_PATH default is /usr/local/krb5/bin/aklog.

Requirements:
Once the patch is applied autoconf will need to be run to create a new configure script.

The following patch was written in NCSA's AFS/Kerberos 5 environment. We have applied Ken Hornstein's AFS-Kerberos 5 migration kit to the MIT version of Kerberos. Some calls may be specific to the migration kit, but I have tried to ifdef them out. If you are using the migration kit then it will look for the following defaults in the krb5.conf file under the [appdefaults] section: 

        forwardable = 1
        krb5_run_aklog = 1
        krb5_aklog_path = /usr/local/krb5/bin/aklog
        default_lifetime = 25h
The krb5_aklog_path will need to be set to the location of your aklog binary. You can set forwardable to 0 or 1 depending if you want to get a forwardable ticket or not. Set default_lifetime to whatever value is appropriate for your site, the default, if not set, is 10 hours. If you are not using the migration kit, but still use aklog to convert a ticket to a token you can specify the path to the aklog binary with the --with-afs-krb5=[PATH] configure option.

You will also need to link in the latest krbafs library from CMU. This library is a modified version of the KTH Kerberos (eBones) libkafs. It was written with some nice and easy AFS library calls. Make sure that you either install the libkrbafs.a library in a location SSH will find, or set the LIBS environment variable (ie. setenv LIBS "-L/usr/ncsa/lib -lkrbafs").

If you find problems or have comments then you can email me at: jbarlow@ncsa.uiuc.edu

  • NCSA AFS/Kerberos 5 patch (patch to ssh-1.2.26)

    Submitted by:
    James J. Barlow < jbarlow@ncsa.uiuc.edu>

    Thanks to Yuji Shinozaki for his comments when testing the patch.

    [an error occurred while processing this directive]