Is FreeBSD's login program compatible with AFS, so you can just login normally instead of using the kinit method (this is possible according to the OpenAFS manual)?
Add a comment
|
2 Answers
No, this is not currently possible on Freebsd 10.1
As per
http://www.eyrie.org/~eagle/software/pam-afs-session/
the required pam-afs-session pam module has been orphaned for about four years now. At some point before 10.1 freebsd shipped it, but it has definitely been removed from 10.1 in ports and packages.
Despite the orphan announcement, RRA's github for pam-afs-session does contain bug fixes and similar small updates, its not entirely abandoned.
The linked instructions at spinlock are awesome and work perfectly, if you have a system that ships pam-afs-session, like Debian, etc. So the linked instructions are correct and workable, just the software no longer exists as part of 10.1
It should theoretically be possible to manually compile and manually install pam-afs-session. My machines have a completely automated hands-off config system (like puppet but different) so doing that kind of manual labor dozens of times on headless machines is not really an option for me. I could hand compile and hand install it once, and rely on my config mgmt system to copy binaries to all the other machines...
Some things I've tried are using pam_exec to run aklog, this does run aklog and successfully obtain a working afs ticket, although its "out of order" such that pam_krb5 has tried to determine the homedir and failed to obtain access, so I'm dumped into root / then the valid afs token is obtained and I'm left with my homedir kinda being / instead of /afs/whatever/user/me/. This is little comfort to XDM which cannot access my homedir so it fails at login.
What does work, is dropping to console CLI which doesn't require xdm to be happy, logging in, getting dumped into root / because my AFS homedirs are un accessible, then manually running aklog, then logging out of the console CLI, then switching to and logging in using xdm, this actually works, although its clumsy and I'd like to improve it.
I'm contemplating writing a very small shell script for pam_exec.so to implement what I need.
Yes, FreeBSD's login program does/can use PAM, as discussed here.
To do this, you need to configure PAM to authenticate to Kerberos/AFS. There are a few guides and examples for how to do this, like this one.
Most guides you find will be for Linux, but the PAM configuration will be very similar on FreeBSD. The way of installing the relevant PAM libraries and setting up the AFS client itself on FreeBSD will be very different, but the PAM configuration should be the same.
