If like UNC your site uses AFS for filesystem space and user accounts, it'a handy to get an AFS token whenever you login to a machine. Here's how to enable a PAM module for use with SSHD (although this module should work for any PAM configuration). Of course, this assumes that the mac you'll be logging into is already setup with an AFS configuration.
This file is what does the work of getting the AFS tokens for you.
You need to copy this file to /usr/lib/pam. The easiest way to do this is to open a terminal window, and cd to whatever folder you downloaded pam_afs.so.1 (you can type cd, then drag the folder from Finder to the terminal window to enter the command if you like). Then type:
sudo cp ./pam_afs.so.1 /usr/lib/pam/
In the /etc/pam.d directory, there are files used by various programs to control authentication. In a terminal window, make a backkup of the sshd file, and then open the sshd file with a text editor (in this example, I'm using vi, but pico or pretty much anything would work as well).
sudo cp /etc/pam.d/sshd /etc/pam.d/sshd.orig sudo vi /etc/pam.d/sshd
Now, if your AFS ID and password match your OS X ID and password, add the line auth optional pam_afs.so.1 as the second line of the file, so that you have the following:
# login: auth account password session auth required pam_nologin.so auth optional pam_afs.so.1 auth sufficient pam_securityserver.so auth sufficient pam_unix.so auth required pam_deny.so account required pam_permit.so password required pam_deny.so session required pam_permit.so
If your AFS ID and password do not match your OS X ID and password, or if you are setting up a machine which doesn't have local user accounts, (eg. a lab machine) try adding the line auth sufficient pam_afs.so.1 try_first_pass as the second line of the file (thanks Stephen!), so that you have the following:
# login: auth account password session auth required pam_nologin.so auth sufficient pam_afs.so.1 try_first_pass auth sufficient pam_securityserver.so auth sufficient pam_unix.so auth required pam_deny.so account required pam_permit.so password required pam_deny.so session required pam_permit.so
And save the file.
First, make sure that Remote Login is enabled in the Sharing Preferences. Then, in terminal window, see if you currently have tokens using the tokens command. If you do, you'll see something like this:
[gilgamesh:/usr/lib/pam] hays% tokens Tokens held by the Cache Manager: User's (AFS ID 4726) tokens for afs@cs.unc.edu [Expires Nov 20 18:03] --End of list--
If you have any tokens, just to be thorough, destroy them with the unlog command, and verify that you don't have them any more.
[gilgamesh:/usr/lib/pam] hays% unlog [gilgamesh:/usr/lib/pam] hays% tokens Tokens held by the Cache Manager: --End of list--
Now, from another machine you'll need to login to your mac using ssh. One way to do this is to ssh to a campus login server such as isis.unc.edu, then ssh back to your machine. Once you're connected, run the tokens command to verify that you do indeed have appropriate AFS tokens.
*Many thanks to David Botsch for providing his modified AFS/PAM source code and suggestions, and Murray Anderegg for the help with understanding PAM.