From owner-freebsd-questions@FreeBSD.ORG Fri Jun 29 09:13:29 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 299F6106564A for ; Fri, 29 Jun 2012 09:13:29 +0000 (UTC) (envelope-from basarevych@gmail.com) Received: from mail-ey0-f182.google.com (mail-ey0-f182.google.com [209.85.215.182]) by mx1.freebsd.org (Postfix) with ESMTP id B1F758FC0A for ; Fri, 29 Jun 2012 09:13:28 +0000 (UTC) Received: by eabm6 with SMTP id m6so1516511eab.13 for ; Fri, 29 Jun 2012 02:13:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=r/80/FoQ6SkIc5f77ytVZ+IsZLXKP7UZNmD9FpfOG8M=; b=M9GeAC9TBWyV3vCC062iWTDZfEL2nh/CQpUfUiJNBM105rolG/Fn+vSM06NjKtvtQ2 1Li5Wef9+XDfOIvPjzUv+nEC8TflqND7nSfPgCBUg5oorTMf4eMHFr1PCrUm+iIuINZh teMlBNXVZqEv7Lz4i9GVrvAnMXHLJftpg7MxBIMzF6kU0VzO8QAmVCzCkBF5NSN6JMQh HsQtWx4d1ksQgC2ouzjIbpWi7Qng6cC1aJhg9BUmuHrLBFDG3V8qBzq75h/JSnElEdGP +jioRGme6ONS6Q5lJBkb8J5ab3Mv0HwohkXPvVIZ1LkXbp5m1lFQt1GJv5tuFIyRL5Vl qtZg== MIME-Version: 1.0 Received: by 10.14.98.202 with SMTP id v50mr423634eef.80.1340961207674; Fri, 29 Jun 2012 02:13:27 -0700 (PDT) Received: by 10.14.53.7 with HTTP; Fri, 29 Jun 2012 02:13:27 -0700 (PDT) Date: Fri, 29 Jun 2012 12:13:27 +0300 Message-ID: From: Ross To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=UTF-8 Subject: sshd and Kerberos X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 09:13:29 -0000 Hello. I setup NIS, Kerberos and Kerberized NFS (v3) server. All the required daemons are running. /usr/home is exported from the server with sec=krb5i And there is a client machine. I uncommented these two lines in /etc/pam.d/system and sshd: auth sufficient pam_krb5.so no_warn try_first_pass password sufficient pam_krb5.so no_warn try_first_pass Now, if I do a local login to the client (on the text console) everything works fine, I get the Kerberos tickets and have access to mounted /usr/home But if I ssh into the client from server I do log in, but I don't get any ticket and access to /usr/home is denied. How to make sshd pam module create Kerberos tickets on login?