Re: [OpenAFS] Token gone after sudo?!

2015-12-31 Thread Chas Williams
It's probably that your /etc/pam.d/sudo is using pam_keyring.so
to set up a new keyring when you sudo.

Do a keyctl list @s before and sudo keyctl list @s and see if
the keyring is being replaced.

On Thu, 2015-12-31 at 00:05 +0100, Alexander Lazarević wrote:
> Hi!
> 
> I just recently upgraded to ubuntu 15.10 and I am using the openafs
> client 1.6.16-0ppa1~ubuntu15.10.2. With the switch to 15.10 I started
> to notice tokens to "disappear".
> 
> The following is an example of how to reliable make tokens disappear
> for me:
> 
> aklog; tokens; sudo ls /dev/null; tokens
> 
> Tokens held by the Cache Manager:
> 
> User's (AFS ID 2) tokens for a...@mydomain.com [Expires Dec 31
> 09:50]
>    --End of list--
> /dev/null
> 
> Tokens held by the Cache Manager:
> 
>    --End of list--
> 
> I can't remember that this would happen. But I surely could be wrong?!
> 
> Regards,
>  Alex
___
OpenAFS-info mailing list
OpenAFS-info@openafs.org
https://lists.openafs.org/mailman/listinfo/openafs-info


Re: [OpenAFS] Token gone after sudo?!

2015-12-31 Thread Benjamin Kaduk
It's very likely to be an issue with the PAM configuration, yes.
I think we've seen some cases where it was pam_afs_session that was
misconfigured and not pam_keyring, but I didn't check the archives,
myself.

-Ben

On Thu, 31 Dec 2015, Chas Williams wrote:

> It's probably that your /etc/pam.d/sudo is using pam_keyring.so
> to set up a new keyring when you sudo.
>
> Do a keyctl list @s before and sudo keyctl list @s and see if
> the keyring is being replaced.
>
> On Thu, 2015-12-31 at 00:05 +0100, Alexander Lazarević wrote:
> > Hi!
> > 
> > I just recently upgraded to ubuntu 15.10 and I am using the openafs
> > client 1.6.16-0ppa1~ubuntu15.10.2. With the switch to 15.10 I started
> > to notice tokens to "disappear".
> > 
> > The following is an example of how to reliable make tokens disappear
> > for me:
> > 
> > aklog; tokens; sudo ls /dev/null; tokens
> > 
> > Tokens held by the Cache Manager:
> > 
> > User's (AFS ID 2) tokens for a...@mydomain.com [Expires Dec 31
> > 09:50]
> >    --End of list--
> > /dev/null
> > 
> > Tokens held by the Cache Manager:
> > 
> >    --End of list--
> > 
> > I can't remember that this would happen. But I surely could be wrong?!
> > 
> > Regards,
> >  Alex
> ___
> OpenAFS-info mailing list
> OpenAFS-info@openafs.org
> https://lists.openafs.org/mailman/listinfo/openafs-info
>