#Pashua for mac os x for mac os x#
#Pashua for mac os x mac os x#
#Pashua for mac os x software#

It refreshes or renews Kerberos tickets based on their discovered status. This script runs both when the user logs in, and as a triggered LaunchAgent. This handoff in duties is necessary because this script runs as a LaunchDaemon in the root context, but Kerberos ticket renewals must be done in the user’s context. If an interface with an IP address is found, it touches a trigger file ( /Library/Application Support/crankd/kmfiles/trigger) that the following script watches. Then (with the help of networksetup -listnetworkserviceorder) it gets a list of ethernet interfaces in service priority order and goes down that list looking for the first one with an ip address. When called, it first sleeps for 30 seconds, allowing sufficient time for a wi-fi or VPN connection to be established. This script’s main purpose is to determine if any ethernet interface (e.g. When a change is detected, it calls the following script. Specifically, it monitors the System Configuration framework’s State:/Network/Global/IPv4 subkey, which blips any time a network interface gains or loses an IPv4 address. Part of the PyMacAdmin project, crankd is an always-on LaunchDaemon configured to look for network changes. You can open up Console.app and filter for “kerbminder” to see what it’s up to. KerbMinder logs its activity to the system log. KerbMinder has a few components that operate in tandem.

crankd (PyMacAdmin, included as a submodule).

#Pashua for mac os x mac os x#

Mac OS X 10.8.5 or newer, including El Capitan (10.11.x).Tim Sutton for telling me about Pashua.Allister Banks for pointing out an effective dig command to test for domain reachability.Francois ‘ftiff’ Levaux-Tiffreau, who is personally responsible for all the changes introduced in v1.3.Portions of KerbMinder were inspired by code written by these fine humans (links point to the inspiring code, where possible): agreeing to the project’s release as open source.

#Pashua for mac os x software#

testing the software through its stages of development.

inspiring and funding the development of KerbMinder.

The largest share of gratitude goes to Purdue Pharma L.P. If you want to skip the details, download the installer now. If KerbMinder detects that you are not bound to AD, the first time it runs it will prompt for a username and domain. That’s right! With KerbMinder, you can do away with binding Macs to Active Directory. users would like the benefits of Kerberos SSO without having to bind the computer to a directory service.users have network-authenticated mobile accounts and often work off of corporate networks via VPN.KerbMinder is designed to provide a seamless, single sign-on (SSO) experience in in environments where after the user changes their password - the keychain will automatically remove the old saved password and the user will be prompted to enter one. Should the saved password get out of sync with the domain - e.g. The password can be saved to the keychain so all subsequent renewals can use it. It only presents a UI if it needs the user to supply a password.

#Pashua for mac os x for mac os x#

KerbMinder is a tool for Mac OS X that keeps a logged-in user’s Kerberos ticket current by attempting to renew or refresh it automatically any time a user logs in or the network state changes.