hi, sorry,i need to add something . i have three servers. ad +kerberos win2008 nis server openafs server linux redhat 6.7 nis slave openafs client linux redhat 6.7 i can use the ad accounts to login the linux server and can get tokens.but the pam configuration with pam_krb5 seems not working.if i use ad+winbind+openafs,the pam configuraiton with pam_krb5 is working fine.do i miss some pam packages?
> > hi, > i modified the /etc/pam.d/system-auth file ,but it did not work,how can i > debug this error?Are there any other files that need to be modified? > > root@test-afs002 cai]# vi /etc/pam.d/system-auth > #%PAM-1.0 > # This file is auto-generated. > # User changes will be destroyed the next time authconfig is run. > auth required pam_env.so > auth sufficient pam_unix.so nullok try_first_pass > auth requisite pam_succeed_if.so uid >= 500 quiet > auth sufficient pam_krb5.afs.so use_first_pass ignore_root > auth required pam_deny.so > > account required pam_unix.so broken_shadow > account sufficient pam_succeed_if.so uid < 500 quiet > account [default=bad success=ok user_unknown=ignore] pam_krb5.so > account [default=bad success=ok user_unknown=ignore] pam_winbind.so > cached_login > account required pam_permit.so > > password requisite pam_cracklib.so try_first_pass retry=3 type= > password sufficient pam_unix.so md5 shadow nullok try_first_pass > use_authtok > password sufficient pam_krb5afs.so use_authtok > password sufficient pam_winbind.so cached_login use_authtok > password required pam_deny.so > > session optional pam_keyinit.so revoke > session required pam_limits.so > session optional pam_oddjob_mkhomedir.so umask=0077 > session [success=1 default=ignore] pam_succeed_if.so service in crond > quiet use_uid > session required pam_unix.so > session optional pam_krb5afs.so > > ~ > > > > > -----原始邮件----- > > 发件人: "Benjamin Kaduk" <ka...@mit.edu> > > 发送时间: 2016-05-06 23:17:46 (星期五) > > 收件人: zhaoxy...@ustc.edu.cn > > 抄送: > > 主题: Re: RE: [OpenAFS] ad+openafs > > > > You should keep the list cc'd for this thread; there are many other people > > with more experience in this regardn than me. > > > > That said, it sounds like you want pam_krb5 and pam_afs_session on the > > linux client, with some configuration knobs set accordingly. > > > > -Ben > > > > On Thu, 5 May 2016, zhaoxy...@ustc.edu.cn wrote: > > > > > > > > hi, > > > the system works now,but i want to get tokens when i login the linux > > > system without input the kinit and aklog command,how can i achieve this > > > goal?do i need to install some packages? > > > > > > sotfware configuration : ad(win 2008 server ) + nis+ openafs 1.6.14 > > > > > > > -----原始邮件----- > > > > 发件人: "Benjamin Kaduk" <ka...@mit.edu> > > > > 发送时间: 2016-05-04 13:44:00 (星期三) > > > > 收件人: "Brandon Allbery" <ballb...@sinenomine.net> > > > > 抄送: "zhaoxy...@ustc.edu.cn" <zhaoxy...@ustc.edu.cn>, > > > > "openafs-info@openafs.org" <openafs-info@openafs.org> > > > > 主题: RE: [OpenAFS] ad+openafs > > > > > > > > 1.6.14 doesn't need to have single-DES enabled; we shouldn't be > > > > recommending it. The rxkad.keytab method should work fine with AES > > > > keys. > > > > > > > > -Ben > > > > > > > > On Tue, 3 May 2016, Brandon Allbery wrote: > > > > > > > > > -1765328370 is KRB5KDC_ERR_ETYPE_NOSUPP. This often means that DES is > > > > > disabled somewhere. Note that the client library *also* needs DES > > > > > enabled; you might need to add to the [libdefaults] section of > > > > > /etc/krb5.conf on the RH system, > > > > > > > > > > allow_weak_crypto = true > > > > > > > > > > From: openafs-info-ad...@openafs.org > > > > > [mailto:openafs-info-ad...@openafs.org] On Behalf Of > > > > > zhaoxy...@ustc.edu.cn > > > > > Sent: Tuesday, May 3, 2016 4:39 AM > > > > > To: openafs-info@openafs.org > > > > > Subject: [OpenAFS] ad+openafs > > > > > > > > > > > > > > > hi > > > > > > > > > > i install openafs1.6.14 on redhat 6.7 and i want to use the ad as > > > > > krb5 auth . > > > > > > > > > > here is my steps: > > > > > > > > > > 1 install openafs1.6.14 on redhat6.7 > > > > > > > > > > 2 install ad on windows 2008 r2 > > > > > > > > > > 3 ktpass -princ afs/cellname@ADDOMAINNAME -mapuser > > > > > afscell@ADDOMAINNAME \ -mapOp add -out afs-keytab +rndPass -crypto > > > > > DES-CBC-CRC +DesOnly \ -ptype KRB5_NT_PRINCIPAL +DumpSalt ) > > > > > > > > > > 4 use kinit wang > > > > > > > > > > aklog > > > > > > > > > > [root@test-afs002 ]# klist -e -f > > > > > Ticket cache: FILE:/tmp/krb5cc_0 > > > > > Default principal: w...@pc.com<mailto:w...@pc.com> > > > > > > > > > > Valid starting Expires Service principal > > > > > 05/03/16 16:26:46 05/04/16 02:26:33 > > > > > krbtgt/pc....@pc.com<mailto:krbtgt/pc....@pc.com> > > > > > renew until 05/10/16 16:26:46, Flags: FRIA > > > > > Etype (skey, tkt): aes256-cts-hmac-sha1-96, > > > > > aes256-cts-hmac-sha1-96 > > > > > 05/03/16 16:27:04 05/04/16 02:26:33 > > > > > afs/pc....@pc.com<mailto:afs/pc....@pc.com> > > > > > renew until 05/10/16 16:26:46, Flags: FRA > > > > > Etype (skey, tkt): arcfour-hmac, arcfour-hmac > > > > > [root@test-afs002 ]# ls /afs/pc.com/ > > > > > ls: cannot open directory /afs/pc.com/: Permission denied > > > > > [root@test-afs002 ]# > > > > > > > > > > if Create a afs user in the AD as a normal user with the login afs, > > > > > set user cannot change passwordd, password never expires. Try to set > > > > > "Use Kerberos DES encryption types for this account" on the Account > > > > > tab. then when i use the command > > > > > > > > > > [root@test-afs002 ]# kinit wang > > > > > Password for w...@pc.com<mailto:w...@pc.com>: > > > > > [root@test-afs002 ]# aklog > > > > > aklog: Couldn't get pc.com AFS tickets: > > > > > aklog: unknown RPC error (-1765328370) while getting AFS tickets > > > > > [root@test-afs002 ]# > > > > > > > > > > i configure the ad follow the web > > > > > https://wiki.openafs.org/win2008r2adaskdc/,but i can't find what is > > > > > wrong with me ?can you tell me ? > > > > > > > > > > thanks > > > > > > > > > > > > > > > > > >