* geofft has [http://web.mit.edu/geofft/Public/bashrc.kpagsh kpagsh], a way of configuring your .bashrc to prompt you for tickets (null instance by default) if you start a shell and don't have tickets. If you want to switch tickets, you start a new shell, and also a new PAG, which lets you use multiple AFS credentials at once, too. It also modifies your prompt.
These aliases are also careful to get shorter lifetime tickets that are marked nonforwardable. Some versions of SSH try to forward tickets by default. Since you might let your root instance tickets access many servers, but not trust all of these servers equally, you don't want your tickets to be forwardable. (Thankfully, recent Debian, Ubuntu, and OS X have turned off this default, but it's a good precaution.)
* geofft has [http://web.mit.edu/geofft/Public/bashrc.kpagsh kpagsh], a way of configuring your .bashrc to prompt you for tickets (null instance by default) if you start a shell and don't have tickets. If you want to switch tickets, you start a new shell, and also a new PAG, which lets you use multiple AFS credentials at once, too. It also modifies your prompt.
These aliases are also careful to get shorter lifetime tickets that are marked nonforwardable. Some versions of SSH try to forward tickets by default. Since you might let your root instance tickets access many servers, but not trust all of these servers equally, you don't want your tickets to be forwardable. (Thankfully, recent Debian, Ubuntu, and OS X have turned off this default, but it's a good precaution.)