Here are some things I've copied from my new Dell. They may or may not
be relevant.

![](media/image1.png){width="6.499305555555556in"
height="5.457638888888889in"}

To get tickets for OpenAFS I had to change things, as shown below:

![](media/image2.png){width="5.645138888888889in"
height="4.093055555555556in"}

![](media/image3.png){width="5.645138888888889in"
height="4.093055555555556in"}

This file was added based on what I read at:

http://computing.fnal.gov/software/netidmgr/netidmgr_and_hummingbird.htm.

![](media/image4.png){width="5.645138888888889in"
height="4.093055555555556in"}

This was done after reading:

http://computing.fnal.gov/software/netidmgr/netidmgr-faq.html#CantUseAfsToken

![](media/image5.png){width="5.645138888888889in"
height="4.093055555555556in"}

See previous statement.

![](media/image6.png){width="3.738888888888889in" height="1.71875in"}

This shows version of FileZilla. Looking at the latest version from
<http://filezilla-project.org/>, it doesn't yet support Kerberos GSS.

![](media/image7.png){width="6.218055555555556in"
height="4.290972222222222in"}

This shows a change I made.

![](media/image8.png){width="6.498611111111111in"
height="4.913888888888889in"}

The above is a screen capture after trying to ftp to outland.fnal.gov. I
turned on debug logging message. Below I show the logfile. It shows a
couple of attempts for fsui02.fnal.gov and finally the attempt for
outland.fnal.gov.

FileZilla started (11/12/2007 16:38:24)

Status: Connecting to fsui02.fnal.gov \...

Trace: ControlSocket.cpp(111): OnAsyncGetHostByName(0, 48, 1)

Trace: FtpControlSocket.cpp(442): OnConnect(0)

Status: Connected with fsui02.fnal.gov. Waiting for welcome message\...

Trace: FtpControlSocket.cpp(317): OnReceive(0)

Response: 220 fsui02 FTP server (Version 5.60) ready.

Trace: GSSApi.dll: GFtpDoAuth(1188, \"fsui02.fnal.gov\", 808837507,
340058499, 525640, 32768, 80, 14744040\[0\])

Trace: GSSApi.dll: Trying to authenticate to \<ftp@fsui02.fnal.gov\>

Trace: GSSApi.dll: Status in line 918: 0, 0

Trace: GSSApi.dll: Status in line 948: 1, 0

FileZilla started (11/12/2007 17:04:07)

Status: Connecting to fsui02.fnal.gov \...

Trace: ControlSocket.cpp(111): OnAsyncGetHostByName(0, 48, 1)

Trace: FtpControlSocket.cpp(442): OnConnect(0)

Status: Connected with fsui02.fnal.gov. Waiting for welcome message\...

Trace: FtpControlSocket.cpp(317): OnReceive(0)

Response: 220 fsui02 FTP server (Version 5.60) ready.

Trace: GSSApi.dll: GFtpDoAuth(408, \"fsui02.fnal.gov\", 808837507,
340058499, 1049862, 32768, 80, 14744040\[0\])

Trace: GSSApi.dll: Trying to authenticate to \<ftp@fsui02.fnal.gov\>

Trace: GSSApi.dll: Status in line 918: 0, 0

Trace: GSSApi.dll: Status in line 948: 1, 0

FileZilla started (11/12/2007 17:29:00)

FileZilla started (11/12/2007 19:19:02)

Status: Connecting to outland.fnal.gov \...

Trace: ControlSocket.cpp(111): OnAsyncGetHostByName(0, 56, 1)

Trace: FtpControlSocket.cpp(442): OnConnect(0)

Status: Connected with outland.fnal.gov. Waiting for welcome message\...

Trace: FtpControlSocket.cpp(317): OnReceive(0)

Response: 220 outland.fnal.gov FTP server (Version 5.60) ready.

Trace: GSSApi.dll: GFtpDoAuth(408, \"outland.fnal.gov\", 808837507,
-108535421, 198296, 32768, 80, 14875112\[0\])

Trace: GSSApi.dll: Trying to authenticate to \<ftp@outland.fnal.gov\>

Trace: GSSApi.dll: Status in line 918: 0, 0

Trace: GSSApi.dll: Status in line 948: 1, 0

Here I show the contents of the following file:

C:\\windows\\krb5.ini file

\# krb5conf v2_3 (without afs) on node i-krb-2.fnal.gov automatic update
03Mar2007

\# V1.13 Added .pic.org.es mapping to FNAL.GOV

\# V1.14 Leave lines with .fnal.gov in \[domain_realms\] section

\# V1.15 Add pam settings to \[appdefaults\] section so the PAM

\# module for OpenSSH gets reasonable tickets (otherwise

\# your cryptocard login gets a 1 hour ticket)

\# V2.0 Add BSS Hot Site DCs and KDCs (at ANL), adjustments to

\# produxction DC list and added WINBETA.FNAL.GOV and

\# FERMIBETA.WINBETA.FNAL.GOVealm DCs as part

\# of PILOT realm additions

\# V2.0a Fixed wisc.edu domain defintion typo

\# V2.1 Added capaths section with transitive trusts, removed

\# checksum_type from libdefaults

\# V2.1a Added domain definitions for the Windows realms

\# V2.2 Added units (m=minutes) to ticket_lifetime in \[libdefaults\],

\# added e898 AFS remapping to \[instancemapping\] section and

\# removed old pam definitions from \[appdefaults\] section which

\# just had a forwardable=true statement

\# V2.3 Removed krb4_convert_524 statement from pam settings in

\# \[appdefaults\] section to speed up logins

\#

\###

\### This krb5.conf template is intended for use with Fermi

\### Kerberos v1_2 and later. Earlier versions may choke on the

\### \"auth_to_local = \" lines unless they are commented out.

\### The installation process should do all the right things in

\### any case, but if you are reading this and haven\'t updated

\### your kerberos product to v1_2 or later, you really should!

\###

\[libdefaults\]

ticket_lifetime = 1560m

default_realm = FERMI.WIN.FNAL.GOV

\[realms\]

FNAL.GOV = {

kdc = krb-fnal-1.fnal.gov:88

kdc = krb-fnal-2.fnal.gov:88

kdc = krb-fnal-3.fnal.gov:88

kdc = krb-fnal-4.fnal.gov:88

kdc = krb-fnal-5.fnal.gov:88

kdc = krb-fnal-6.fnal.gov:88

kdc = krb-fnal-7.fnal.gov:88

master_kdc = krb-fnal-admin.fnal.gov:88

admin_server = krb-fnal-admin.fnal.gov

default_domain = fnal.gov

}

WIN.FNAL.GOV = {

kdc = littlebird.win.fnal.gov:88

kdc = bigbird.win.fnal.gov:88

default_domain = fnal.gov

}

FERMI.WIN.FNAL.GOV = {

kdc = sully.fermi.win.fnal.gov:88

kdc = elmo.fermi.win.fnal.gov:88

kdc = grover.fermi.win.fnal.gov:88

kdc = oscar.fermi.win.fnal.gov:88

kdc = cookie.fermi.win.fnal.gov:88

kdc = herry.fermi.win.fnal.gov:88

default_domain = fnal.gov

}

UCHICAGO.EDU = {

kdc = kerberos-0.uchicago.edu

kdc = kerberos-1.uchicago.edu

kdc = kerberos-2.uchicago.edu

admin_server = kerberos.uchicago.edu

default_domain = uchicago.edu

}

PILOT.FNAL.GOV = {

kdc = i-krb-2.fnal.gov:88

master_kdc = i-krb-2.fnal.gov:88

admin_server = i-krb-2.fnal.gov

default_domain = fnal.gov

}

WINBETA.FNAL.GOV = {

kdc = wbdc1.winbeta.fnal.gov:88

kdc = wbdc2.winbeta.fnal.gov:88

default_domain = fnal.gov

}

FERMIBETA.WINBETA.FNAL.GOV = {

kdc = fbdc1.fermibeta.winbeta.fnal.gov:88

kdc = fbdc2.fermibeta.winbeta.fnal.gov:88

default_domain = fnal.gov

}

\[instancemapping\]

afs = {

cron/\* = \"\"

cms/\* = \"\"

afs/\* = \"\"

e898/\* = \"\"

}

\[capaths\]

\# FNAL.GOV and PILOT.FNAL.GOV are the MIT Kerberos Domains

\# FNAL.GOV is production and PILOT is for testing

\# The FERMI Windows domain uses the WIN.FNAL.GOV root realm

\# with the FERMI.WIN.FNAL.GOV sub-realm where machines and users

\# reside. The WINBETA and FERMIBETA domains are the equivalent

\# testing realms for the FERMIBETA domain. The 2-way transitive

\# trust structure of this complex is as follows:

\#

\# FNAL.GOV \<=\> PILOT.FNAL.GOV

\# FNAL.GOV \<=\> WIN.FERMI.GOV \<=\> FERMI.WIN.FERMI.GOV

\# PILOT.FNAL.GOV \<=\> WINBETA.FNAL.GOV \<=\>
FERMIBETA.WINBETA.FNAL.GOV

FNAL.GOV = {

PILOT.FNAL.GOV = .

FERMI.WIN.FNAL.GOV = WIN.FNAL.GOV

WIN.FNAL.GOV = .

FERMIBETA.WINBETA.FNAL.GOV = WINBETA.FNAL.GOV

WINBETA.FNAL.GOV = PILOT.FNAL.GOV

}

PILOT.FNAL.GOV = {

FNAL.GOV = .

FERMI.WIN.FNAL.GOV = WIN.FNAL.GOV

WIN.FNAL.GOV = FNAL.GOV

FERMIBETA.WINBETA.FNAL.GOV = WINBETA.FNAL.GOV

WINBETA.FNAL.GOV = .

}

WIN.FNAL.GOV = {

FNAL.GOV = .

PILOT.FNAL.GOV = FNAL.GOV

FERMI.WIN.FNAL.GOV = .

FERMIBETA.WINBETA.FNAL.GOV = WINBETA.FNAL.GOV

WINBETA.FNAL.GOV = PILOT.FNAL.GOV

}

WINBETA.FNAL.GOV = {

PILOT.FNAL.GOV = .

FERMIBETA.WINBETA.FNAL.GOV = .

FNAL.GOV = PILOT.FNAL.GOV

FERMI.WIN.FNAL.GOV = WIN.FNAL.GOV

WIN.FNAL.GOV = PILOT.FNAL.GOV

}

\[logging\]

kdc = SYSLOG:info:local1

admin_server = SYSLOG:info:local2

default = SYSLOG:err:auth

\[domain_realm\]

\# Fermilab\'s (non-windows-centric) domains

.fnal.gov = FNAL.GOV

.cdms-soudan.org = FNAL.GOV

.deemz.net = FNAL.GOV

.dhcp.fnal.gov = FNAL.GOV

.minos-soudan.org = FNAL.GOV

i-krb-2.fnal.gov = PILOT.FNAL.GOV

.win.fnal.gov = WIN.FNAL.GOV

.fermi.win.fnal.gov = FERMI.WIN.FNAL.GOV

.winbeta.fnal.gov = WINBETA.FNAL.GOV

.fermibeta.winbeta.fnal.gov = FERMIBETA.WINBETA.FNAL.GOV

\# Friends and family (by request)

.cs.ttu.edu = FNAL.GOV

.geol.uniovi.es = FNAL.GOV

.harvard.edu = FNAL.GOV

.hpcc.ttu.edu = FNAL.GOV

.infn.it = FNAL.GOV

.knu.ac.kr = FNAL.GOV

.lns.mit.edu = FNAL.GOV

.ph.liv.ac.uk = FNAL.GOV

.pha.jhu.edu = FNAL.GOV

.phys.ttu.edu = FNAL.GOV

.phys.ualberta.ca = FNAL.GOV

.physics.lsa.umich.edu = FNAL.GOV

.physics.ucla.edu = FNAL.GOV

.physics.ucsb.edu = FNAL.GOV

.physics.utoronto.ca = FNAL.GOV

.rl.ac.uk = FNAL.GOV

.rockefeller.edu = FNAL.GOV

.rutgers.edu = FNAL.GOV

.sdsc.edu = FNAL.GOV

.sinica.edu.tw = FNAL.GOV

.tsukuba.jp.hep.net = FNAL.GOV

.ucsd.edu = FNAL.GOV

.unl.edu = FNAL.GOV

.in2p3.fr = FNAL.GOV

.wisc.edu = FNAL.GOV

.pic.org.es = FNAL.GOV

\# The whole \"top half\" is replaced during \"ups installAsRoot
krb5conf\", so:

\# It would probably be a bad idea to change anything on or above this
line

\# If you need to add any .domains or hosts, put them here

\[domain_realm\]

.ts.infn.it = PILOT.FNAL.GOV

.pi.infn.it = PILOT.FNAL.GOV

.physics.lsa.umich.edu = FNAL.GOV

.phys.ttu.edu = FNAL.GOV

mojo.lunet.edu = FNAL.GOV

\[logging\]

default = SYSLOG:ERR:AUTH

\[appdefaults\]

default_lifetime = 7d

retain_ccache = false

autologin = true

forward = false

renewable = true

encrypt = true

krb5_aklog_path = /usr/krb5/bin/aklog

telnet = {

}

rcp = {

forward = false

encrypt = false

allow_fallback = true

}

rsh = {

allow_fallback = true

}

rlogin = {

allow_fallback = false

}

login = {

forwardable = true

krb5_run_aklog = false

krb5_get_tickets = true

krb4_get_tickets = false

krb4_convert = false

}

kinit = {

forwardable = true

krb5_run_aklog = false

}

pam = {

forwardable = true

}

rshd = {

krb5_run_aklog = false

}

ftpd = {

krb5_run_aklog = false

default_lifetime = 6h

}