Getting AFS Tokens via PAM for SSHD

If like UNC your site uses AFS for filesystem space and user accounts, it'a handy to get an AFS token whenever you login to a machine. Here's how to enable a PAM module for use with SSHD (although this module should work for any PAM configuration). Of course, this assumes that the mac you'll be logging into is already setup with an AFS configuration.

Step 1. Get the pam_afs.so.1 module

This file is what does the work of getting the AFS tokens for you.

You need to copy this file to /usr/lib/pam. The easiest way to do this is to open a terminal window, and cd to whatever folder you downloaded pam_afs.so.1 (you can type cd, then drag the folder from Finder to the terminal window to enter the command if you like). Then type:

sudo cp ./pam_afs.so.1 /usr/lib/pam/

Step 2. Modify the SSHD configuration for PAM

In the /etc/pam.d directory, there are files used by various programs to control authentication. In a terminal window, make a backkup of the sshd file, and then open the sshd file with a text editor (in this example, I'm using vi, but pico or pretty much anything would work as well).

sudo cp /etc/pam.d/sshd /etc/pam.d/sshd.orig
sudo vi /etc/pam.d/sshd

Now, if your AFS ID and password match your OS X ID and password, add the line auth optional pam_afs.so.1 as the second line of the file, so that you have the following:

# login: auth account password session
auth       required       pam_nologin.so
auth       optional       pam_afs.so.1
auth       sufficient     pam_securityserver.so
auth       sufficient     pam_unix.so
auth       required       pam_deny.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so

If your AFS ID and password do not match your OS X ID and password, or if you are setting up a machine which doesn't have local user accounts, (eg. a lab machine) try adding the line auth sufficient pam_afs.so.1 try_first_pass as the second line of the file (thanks Stephen!), so that you have the following:

# login: auth account password session
auth       required       pam_nologin.so
auth       sufficient     pam_afs.so.1 try_first_pass
auth       sufficient     pam_securityserver.so
auth       sufficient     pam_unix.so
auth       required       pam_deny.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so

And save the file.

Step 3. Test

First, make sure that Remote Login is enabled in the Sharing Preferences. Then, in terminal window, see if you currently have tokens using the tokens command. If you do, you'll see something like this:

[gilgamesh:/usr/lib/pam] hays% tokens
   
Tokens held by the Cache Manager:
   
User's (AFS ID 4726) tokens for afs@cs.unc.edu [Expires Nov 20 18:03]
   --End of list--

If you have any tokens, just to be thorough, destroy them with the unlog command, and verify that you don't have them any more.

[gilgamesh:/usr/lib/pam] hays% unlog
[gilgamesh:/usr/lib/pam] hays% tokens
   
Tokens held by the Cache Manager:
   
   --End of list--

Now, from another machine you'll need to login to your mac using ssh. One way to do this is to ssh to a campus login server such as isis.unc.edu, then ssh back to your machine. Once you're connected, run the tokens command to verify that you do indeed have appropriate AFS tokens.

*Many thanks to David Botsch for providing his modified AFS/PAM source code and suggestions, and Murray Anderegg for the help with understanding PAM.