This is the README for pam-openafs-session, a PAM SESSION module 
which executes aklog in pam_open_session and unlog  
pam_close_session.

This module can be useful just in conjunction with libpam-krb5
and, of course, openafs-krb5

I use the module adding the line

session    required   pam_openafs_session.so 


in /etc/pam.d/login.

For other services that call pam_setcred after pam_open_session , you
might want to use the session component of libpam_krb5, like this:

auth sufficient pam_krb5.so
account sufficient pam_krb5.so
session optional pam_krb5.so
session optional pam_openafs_session.so


Lukas Nellen <lukas@nuclecu.unam.mx> points out that the previous
configuration is not optimal for ssh.  It means that ssh will only get
tokens in you open an interactive session.  You may want tokens for
scp.  On Linux, you can try something like the following:

auth       [success=ok default=1]   pam_krb5.so forwardable 
auth       [default=done]     pam_openafs_session.so 
