[olePigeon]

AppleShare is driving me nuts, how do I NOT save a password? When I Apple-K and connect to the server, it automatically logs in. I've deleted Keychain preferences and it still does it.

I made very sure to NOT click the store password in Keychain, but it auto-mounts anyway.

Where is this stupid thing stored and how do I delete it so it stops auto-mounting without asking for a password?

This is Leopard 10.5.5.

[Art Vandelay]

If you're using Kerberos, then your credentials remain valid until your ticket expires. I think the default is 8 hours.

[olePigeon]

Originally Posted by Art Vandelay 

If you're using Kerberos, then your credentials remain valid until your ticket expires. I think the default is 8 hours.

So how do I delete any Kerberos stored passwords?

[olePigeon]

Nevermind, I found it. THANK GOD.

Anyone else losing hair over this, delete the following from the Library/Preferences/ folder:

edu.mit.Kerberos

[Art Vandelay]

You just disabled Kerberos on that Mac. If that's your goal fine, but if you want to keep using Kerberos then you need to restore the file. There are Kerberos tools for dealing with your tickets.

[olePigeon]

Originally Posted by Art Vandelay 

You just disabled Kerberos on that Mac. If that's your goal fine, but if you want to keep using Kerberos then you need to restore the file. There are Kerberos tools for dealing with your tickets.

Are you sure it disables it? Won't the server just create a new one?

Wouldn't mind a tool, though.

[CharlesS]

I would assume that if it is in Library/Preferences, it will rebuild after being deleted.

It's not in the user template, after all, so it won't exist on first login anyway.

I wouldn't worry too much about it.

[Art Vandelay]

It's in /Library not ~/Library. It is created by Directory Utility when you configure your directory services. It's easy to recreate. My point is that one shouldn't be deleting files when one doesn't really understand how things are working.

[olePigeon]

So does anyone know if there's a setting on OS X Server to tell it NOT generate an 8 hour ticket for AppleShare? Students who share the "Student" login on some machines can't mount their share point, or it automatically mounts someone else' without asking for a password. We don't have a centralized login system.

[Art Vandelay]

Turn off Kerberos for AFP on the file servers. Server Admin > your server > AFP > Settings > Access.

[olePigeon]

Well, I found this:

http://support.apple.com/kb/TA24992?viewlocale=en_US

At least for me, this'll be helpful. But I doubt the students will know how to do it. Maybe I can make an AppleScript that'll clear all Kerberos tickets.

[olePigeon]

Originally Posted by Art Vandelay 

Turn off Kerberos for AFP on the file servers. Server Admin > your server > AFP > Settings > Access.

Yeah, I saw that, but it's supposedly a security risk. But that may be the only way to go.

[Art Vandelay]

How is it any different then killing it on the client? If you're not using Kerberos, you're not using it. Doesn't matter which end is turned off.

[olePigeon]

Ah, found the app kdestroy. I can make an AppleScript that runs that first before connecting to the AppleShare server, then it should ask for the password.

[olePigeon]

Originally Posted by Art Vandelay 

How is it any different then killing it on the client? If you're not using Kerberos, you're not using it. Doesn't matter which end is turned off.

Kerberos isn't encrypted? I'm a little confused.

[olePigeon]

In any event, I've learned a ton. Thanks Art. I've kept notes. Managed to get both the Home folder Mounts working and solved the password problem for AFP for the time being.

[Art Vandelay]

Kerberos is encrypted but so is standard AFP authentication. My point is that if you're using standard AFP authentication, it doesn't matter whether you killed the ticket on the client or disabled it on the server. You're still not using Kerberos in either case. I recommend turning it off on the server if you don't need Kerberos. It's much simpler than devising scripts to get around Kerberos on the client.

[Art Vandelay]

Btw, good luck on your new trial by fire job. It's not easy being thrown into a job you're not familiar with.

[CharlesS]

Originally Posted by Art Vandelay 

It's in /Library not ~/Library. It is created by Directory Utility when you configure your directory services. It's easy to recreate. My point is that one shouldn't be deleting files when one doesn't really understand how things are working.

I don't have an edu.mit.kerberos.plist in my /Library/Preferences, just in my ~/Library/Preferences.

I would assume that the file you're referring to would be somewhere other than the preferences folder.

(I actually don't seem to have any files with "Kerberos" in their name anywhere inside my /Library folder - a search comes up empty)

[Art Vandelay]

It's created by Directory Utility when you configure your directory services (like I mentioned above ).

If you aren't connecting to any Open Directory, Active Directory, or LDAP servers, then you won't have one.

It's in /Library/Preferences/. The file in ~/Library/Preferences/ is edu.mit.kerberos.pkinit.plist, not edu.mit.kerberos.plist.

[olePigeon]

Originally Posted by CharlesS 

I don't have an edu.mit.kerberos.plist in my /Library/Preferences, just in my ~/Library/Preferences.

I would assume that the file you're referring to would be somewhere other than the preferences folder.

(I actually don't seem to have any files with "Kerberos" in their name anywhere inside my /Library folder - a search comes up empty)

My computer is bound to our Open Directory server, so it makes one.

[CharlesS]

Originally Posted by Art Vandelay 

It's in /Library/Preferences/. The file in ~/Library/Preferences/ is edu.mit.kerberos.pkinit.plist, not edu.mit.kerberos.plist.

[Art Vandelay]

Has your account migrated from previous versions? That's no longer there in Leopard or even Tiger iirc. Since it's an old style preference file, I'd say it's quite old.

[CharlesS]

The account's migrated, so I guess that could be it then. However, I notice that my file doesn't have a .plist extension, and neither did the file that olePigeon deleted, and he also specified Library/Preferences without the slash in front - so what he deleted is probably the same thing as what I'm seeing here in either case, and thus I doubt he deleted anything important.

[Art Vandelay]

olePigeon, can you confirm for us which one you deleted?

[olePigeon]

/Library/Preferences

Removing it did make Kerberos stop.