The Final Word on AFS PAGs and Services

Yeah... right. But for now (hopefully) (maybe).

Anyway, what I did was move pam_krb5 and pam_afs_session out of /etc/pam.d/common-* and ONLY put it in PAM stacks that need it. That would be dovecot, ssh, login and passwd. So now if you ssh to the server, you have a PAG. If you sudo -s, you have the same PAG. If you su, you have the same PAG. So start a new pagsh (this is important, if you don't, your unprivileged user will get the tokens and when you log out, pam_afs_session will destroy them). Now you can su - www-data -c 'k5start ...' and then 'apache2ctl start' and it works because Apache starts with the same PAG.

You can run apache2ctl graceful and restart from a shell with any PAG since it does not start the master (root) apache2 process (which has the original PAG), but if you need to fully restart Apache (e.g. stop/start) you'll need to start a new PAG and restart k5start under the new PAG.

So what I've done is gotten rid of the wrapped postfix/local and the foregrounded Dovecot and just wrapped their init scripts to run the start/restart methods inside a pagsh.

More later? Dunno.