Nur in openssh-5.1p1.afs: afsxauth.
diff -ru openssh-5.1p1.noafs/debian/changelog openssh-5.1p1.afs/debian/changelog
--- openssh-5.1p1.noafs/debian/changelog	2009-03-30 14:01:15.000000000 +0200
+++ openssh-5.1p1.afs/debian/changelog	2009-04-23 14:02:20.000000000 +0200
@@ -1,3 +1,14 @@
+openssh (2:5.1p1-5+1afs+sc+6lenny) unstable; urgency=low
+
+  * backport to lenny
+  * added InstantAFS-modifications:
+     * AFS-Tokens will be aquired on Kerberos-Login
+     * Modified ssh_config and sshd_config
+     * added Smartcard-Support
+     * added xauth-wrapper
+
+ -- Frank Burkhardt <burk@cbs.mpg.de>  Thu, 23 Apr 2009 14:02:16 +0200
+
 openssh (1:5.1p1-5) unstable; urgency=low
 
   * Backport from upstream CVS (Markus Friedl):
diff -ru openssh-5.1p1.noafs/debian/rules openssh-5.1p1.afs/debian/rules
--- openssh-5.1p1.noafs/debian/rules	2009-03-30 14:01:15.000000000 +0200
+++ openssh-5.1p1.afs/debian/rules	2009-04-23 14:02:03.000000000 +0200
@@ -68,6 +68,10 @@
 confflags += --with-privsep-path=/var/run/sshd
 confflags += --without-rand-helper
 
+# InstantAFS
+confflags += --with-krb5
+confflags += --with-opensc
+
 # The Hurd needs libcrypt for res_query et al.
 ifeq ($(DEB_HOST_ARCH_OS),hurd)
 confflags += --with-libs=-lcrypt
@@ -103,12 +107,17 @@
 confflags += --with-cflags='$(cflags)'
 confflags_udeb += --with-cflags='$(cflags_udeb)'
 
+# InstantAFS: move pam service name from sshd to ssh
+cflags += -DSSHD_PAM_SERVICE=\"ssh\"
+
 # Linker flags.
 ifneq ($(PIE_LDFLAGS),)
 confflags += --with-ldflags='$(PIE_LDFLAGS)'
 endif
 
-build: build-deb build-udeb
+# InstantAFS: no udebs
+build: build-deb
+#build: build-deb build-udeb
 
 build-deb: build-deb-stamp
 build-deb-stamp:
@@ -163,9 +172,13 @@
 
 	$(MAKE) -C build-deb DESTDIR=`pwd`/debian/openssh-client install-nokeys
 
-	rm -f debian/openssh-client/etc/ssh/sshd_config
+	# InstantAFS: Move sshd_config from openssh-client to openssh-server
+	mkdir -p debian/openssh-server/etc/ssh
+	mv debian/openssh-client/etc/ssh/sshd_config debian/openssh-server/etc/ssh
+
+	# InstantAFS: Actually, we do...
 	#Temporary hack: remove /usr/share/Ssh.bin, since we have no smartcard support anyway.
-	rm -f debian/openssh-client/usr/share/Ssh.bin
+	#rm -f debian/openssh-client/usr/share/Ssh.bin
 
 	# Split off the server.
 	mv debian/openssh-client/usr/sbin/sshd debian/openssh-server/usr/sbin/
@@ -190,11 +203,12 @@
 	install -o root -g root -m 644 debian/openssh-server.default debian/openssh-server/etc/default/ssh
 	install -o root -g root debian/openssh-server.if-up debian/openssh-server/etc/network/if-up.d/openssh-server
 
-	install -m 755 build-udeb/ssh debian/openssh-client-udeb/usr/bin/ssh
-	install -m 755 build-udeb/scp debian/openssh-client-udeb/usr/bin/scp
-	install -m 755 build-udeb/sftp debian/openssh-client-udeb/usr/bin/sftp
-	install -m 755 build-udeb/sshd debian/openssh-server-udeb/usr/sbin/sshd
-	install -m 755 build-udeb/ssh-keygen debian/openssh-server-udeb/usr/bin/ssh-keygen
+	# InstantAFS: no udebs
+	#install -m 755 build-udeb/ssh debian/openssh-client-udeb/usr/bin/ssh
+	#install -m 755 build-udeb/scp debian/openssh-client-udeb/usr/bin/scp
+	#install -m 755 build-udeb/sftp debian/openssh-client-udeb/usr/bin/sftp
+	#install -m 755 build-udeb/sshd debian/openssh-server-udeb/usr/sbin/sshd
+	#install -m 755 build-udeb/ssh-keygen debian/openssh-server-udeb/usr/bin/ssh-keygen
 
 	# Remove version control tags to avoid unnecessary conffile
 	# resolution steps for administrators.
@@ -202,6 +216,9 @@
 		debian/openssh-client/etc/ssh/moduli \
 		debian/openssh-client/etc/ssh/ssh_config
 
+	# InstantAFS: xauth-wrapper
+	install -m 755 afsxauth debian/openssh-server/usr/sbin/afsxauth.openssh-server
+
 # Build architecture-independent files here.
 binary-indep: binary-ssh binary-ssh-krb5
 
diff -ru openssh-5.1p1.noafs/servconf.c openssh-5.1p1.afs/servconf.c
--- openssh-5.1p1.noafs/servconf.c	2009-03-30 14:01:15.000000000 +0200
+++ openssh-5.1p1.afs/servconf.c	2009-03-30 14:52:48.000000000 +0200
@@ -355,12 +355,15 @@
 	{ "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
 	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
 	{ "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
-#ifdef USE_AFS
+/* InstantAFS: Always enable getafstoken-option
+ #ifdef USE_AFS
+ 	{ "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
+ #else
+ 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
+ #endif
+*/
 	{ "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
 #else
-	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
-#endif
-#else
 	{ "kerberosauthentication", sUnsupported, SSHCFG_ALL },
 	{ "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
 	{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
diff -ru openssh-5.1p1.noafs/session.c openssh-5.1p1.afs/session.c
--- openssh-5.1p1.noafs/session.c	2008-06-16 15:29:18.000000000 +0200
+++ openssh-5.1p1.afs/session.c	2009-03-30 15:09:28.000000000 +0200
@@ -59,6 +59,9 @@
 #include <string.h>
 #include <unistd.h>
 
+/* InstantAFS */
+#include <fcntl.h>
+
 #include "openbsd-compat/sys-queue.h"
 #include "xmalloc.h"
 #include "ssh.h"
@@ -1649,6 +1652,9 @@
 	struct passwd *pw = s->pw;
 	int r = 0;
 
+	/* InstantAFS: needed for aklog-exec() */
+	int pid,waitstatus;
+
 	/* remove hostkey from the child's memory */
 	destroy_sensitive_data();
 
@@ -1735,6 +1741,46 @@
 	 */
 	environ = env;
 
+	/* InstantAFS: try to fetch AFS-token even if krb5-libs don't support that,
+		which is mainly the cause, when MIT-kerberos is in use. */
+#if defined(KRB5) && ! defined(USE_AFS)
+	if ( options.kerberos_get_afs_token ) {
+		if (s->authctxt->krb5_ctx != NULL) {
+			printf("##### found authctx\n");
+		}
+		pid=fork();
+		if ( pid >= 0 ) {
+			if ( pid == 0 ) {
+				close(1);
+				close(2);
+				open("/dev/null", O_RDWR);
+				open("/dev/null", O_RDWR);
+				execle("/usr/bin/aklog","aklog","-setpag",NULL,environ);
+				exit(1);
+			} else {
+				waitstatus=-1;
+				wait(&waitstatus);
+			}
+		}
+		/* Once more for the stupid bug, preventing aklog from working
+			properly when setting pag... */
+		pid=fork();
+		if ( pid >= 0 ) {
+			if ( pid == 0 ) {
+				close(1);
+				close(2);
+				open("/dev/null", O_RDWR);
+				open("/dev/null", O_RDWR);
+				execle("/usr/bin/aklog","aklog",NULL,environ);
+				exit(1);
+			} else {
+				waitstatus=-1;
+				wait(&waitstatus);
+			}
+		}
+	}
+#endif
+
 #if defined(KRB5) && defined(USE_AFS)
 	/*
 	 * At this point, we check to see if AFS is active and if we have
diff -ru openssh-5.1p1.noafs/ssh_config openssh-5.1p1.afs/ssh_config
--- openssh-5.1p1.noafs/ssh_config	2009-03-30 14:01:15.000000000 +0200
+++ openssh-5.1p1.afs/ssh_config	2009-03-30 14:45:44.000000000 +0200
@@ -46,7 +46,18 @@
 #   Tunnel no
 #   TunnelDevice any:any
 #   PermitLocalCommand no
-    SendEnv LANG LC_*
-    HashKnownHosts yes
-    GSSAPIAuthentication yes
-    GSSAPIDelegateCredentials no
+
+# InstantAFS: removed:
+#    SendEnv LANG LC_*
+#    HashKnownHosts yes
+#    GSSAPIAuthentication yes
+#    GSSAPIDelegateCredentials no
+
+# InstantAFS:
+	ForwardX11 yes
+	ProtocolKeepAlives 300
+	GSSAPIAuthentication yes
+	GSSAPIDelegateCredentials yes
+	PreferredAuthentications=gssapi-with-mic,publickey,password,keyboard-interactive
+	CheckHostIP no
+	HashKnownHosts no
diff -ru openssh-5.1p1.noafs/sshd_config openssh-5.1p1.afs/sshd_config
--- openssh-5.1p1.noafs/sshd_config	2009-03-30 14:01:15.000000000 +0200
+++ openssh-5.1p1.afs/sshd_config	2009-03-30 14:49:44.000000000 +0200
@@ -119,3 +119,17 @@
 #	X11Forwarding no
 #	AllowTcpForwarding no
 #	ForceCommand cvs server
+
+# InstantAFS
+AllowTcpForwarding yes
+X11Forwarding yes
+UsePrivilegeSeparation no
+GSSAPIAuthentication yes
+GSSAPICleanupCredentials yes
+KerberosAuthentication yes
+KerberosTicketCleanup yes
+PermitRootLogin yes
+ChallengeResponseAuthentication yes
+UsePAM yes
+XAuthLocation /usr/sbin/afsxauth.openssh-server
+KerberosGetAfsToken yes
