Write Kerberos/AFS script about mosh HOT 7 CLOSED

Done. http://web.mit.edu/mosh_project/arch/amd64_deb60/bin/mosh-server

from mosh.

Is this ticket-copying script currently recommended for use? With the official 1.2.4 release on Ubuntu, I can't forward existing Kerberos tickets to the mosh target. However, I copied in the Perl script above as mosh-server and made the current binary mosh-server be mosh-server.real, and ticket forwarding works.

Should this behavior work without this hack in newer versions, or is this a necessary workaround? I'm just trying to understand it since I don't see traces of this direction in github.

from mosh.

SSH should be able to delegate GSS (Kerberos, in your case) credentials.

Of course, SSH can also keep re-delegating credentials as they get
refreshed... Mosh would need something similar, but the obvious thing to
do is to just run ssh again to delegate new credentials, unless you want
mosh to be able to do it itself for some reason, but now one starts
wondering why bother with ssh at all...

from mosh.

@matted, the script is in regular use at MIT. It's not an official part of Mosh but you are welcome to use it.

The problem is not with SSH or Kerberos specifically, but most installations of SSH and Kerberos today use PAM to kdestroy when the session ends. That's a problem for Mosh where the SSH session is only very brief (to launch the mosh-server, which lingers after the SSH connection closes). So this ticket-copying script is necessary in that case.

from mosh.

Thanks for the clarification and explanation, good to know.

I'm actually in CSAIL too... and I guess this is only useful to a small subset of users, but is this wrapper script sitting in any official or semi-official CSAIL or Athena AFS location? I can set it up myself on my machines, but I thought I'd see if a better solution existed. The mosh-server at /afs/csail/system/amd64_linux26/local/bin/ is the standard binary one, and older (1.1.3).

from mosh.

Hello Matt,

Yes, it's sitting in the mosh_project locker on Athena (see above URL). I think the CSAIL sysadmins would probably be happy to upgrade their mosh-server and/or install this wrapper script if we prodded them.

Maybe the best path is for you to get it working on your machine, make sure it works, and then email TIG.

Cheers,
Keith

from mosh.

P.S. I'm happy to be part of the discussion if you want me to -- [email protected]

from mosh.