3

I have the following situation, I have a running GNU screen session where I can't access AFS anymore - my token has expired. I can however access it from a new shell. The difference to this question is that I don't have a Kerberos ticket (well, not for the realm aklog is looking for), so I can't call aklog. I also can't get such a ticket. I have no idea how AFS is set up, but it works.

Now, Kerberos tickets are "stored" in /tmp/krb5cc*, and pointed to by a variable called KRB5CCNAME. If I have this problem with Kerberos and screen/tmux, I can either do kinit, or transplant the newer ticket to the old shell by setting KRB5CCNAME.

I wonder how AFS credentials are pointed to, and if I can similarly transplant them from the outer shell (the one I ssh into, which has AFS access) to the inner shell (the one I get after screen -r, which has no more AFS access). There seems to be no relevant environment variable changed between both shells. strace tokens tells me that it just accesses /proc/fs/openafs/afs_ioctl, which suggests it is tied to the process and using a special kernel feature, which would make it pretty hard. Any ideas how I can get AFS access back in my shell without closing it and opening a new one?

Improve this question

1 Answer 1

Reset to default
3

When you log in via ssh and pam_afs_session.so is active, it will generate a Kerberos ticket and use that to make an AFS token. When you log out, it will remove both the Kerberos ticket and the AFS token.

As you have noted, Kerberos tickets are stored in files, and AFS tokens are stored in the kernel, in a PAG (Process Authentication Group). When you connect through a second SSH session, the pam_afs_session.so library will create a new Kerberos ticket in a new file, and a new AFS token in a new PAG.

The easiest way to keep your AFS token active in a GNU screen session is:

  1. Make a new Kerberos ticket file. The existing one is probably something like /tmp/krb5cc_UID_RANDOM. Make one with a new RANDOM string.
  2. Copy the existing ticket file to the new one you just created.
  3. Change (and export) the KRB5CCNAME environment variable to the new name you created.
  4. Launch screen -r
  5. You may now log out from your outer shell. This will remove your Kerberos ticket from your old ticket file, but your copy will still be valid in the inner shell. However, it also removes your AFS token, so...
  6. When you reconnect to the inner shell, run aklog. This will copy your Kerberos ticket (that you saved) to a new AFS token. It should remain valid until it expires. Before you exit your inner shell, you should probably run kdestroy to remove the Kerberos ticket that you will no longer need.
Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.