Hartmut Brandt wrote: > tmclaugh_at_sdf.lonestar.org wrote: >>> Hi Tom, >>> >>> On Sat, 28 Feb 2009, Tom McLaughlin wrote: >>> >>> TM>Tom McLaughlin wrote: >>> TM>> Harti Brandt wrote: >>> TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt_at_dlr.de wrote: >>> TM> >>> TM>> > > Both create entries in /var/log/messages like: >>> TM>> > > >>> TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error: >>> Miscellaneous >>> TM>> > > failure (see >>> TM>> > > >>> text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ >>> TM>Z >>> TM>> Z >>> TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ >>> TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ >>> TM>> > > >>> TM>> > > I've tried to figure out in which of the dozens of layered >>> libraries >>> TM>> > > (gss, sasl, ssl, ......) this error is generated but did not find >>> TM>> > > anything. >>> TM>> > > >>> TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in >>> sshd_config >>> TM>> > > (as I said, this worked before). >>> TM>> > So to answer my own mail: I made a link from the kerberos ticket >>> file >>> TM>> > which contains the host ticket (and is specified in nss_ldap.conf) >>> to >>> TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, though. >>> TM>> >>> TM>> There may be an issue with the env method used in nss_ldap to change >>> the >>> TM>> credentials cache. My mind is fuzzy but I do recall a similar issue >>> but >>> TM>> don't remember the exact cause or case. nss_ldap has a second >>> configurable >>> TM>> ccname method which when I submitted the original patch I intended to >>> TM>> switch to once we had a newer heimdal. Once I get nss_ldap working >>> on my >>> TM>> box I intend to submit another patch. >>> TM>> >>> TM>> tom >>> TM> >>> TM>Hi Harti (CC maintainer), >>> TM> >>> TM>Can you try the attached patch for nss_ldap? This should cause the >>> host >>> TM>ticket to work correctly on -CURRENT. It's "my box approved". >>> >>> Does not work. I rebuilt my system with today's sources to be sure, >>> removed my patches to the two library makefiles and rebuilt nss_ldap with >>> your patch. I get: >>> >>> # ls -l >>> dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol >>> "GSS_C_NT_HOSTBASED_SERVICE" >>> /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol >>> "gss_oid_equal" >>> >>> Basically on everything I enter. Luckily vi still works :-) >>> >>> I saw that the configuration script claims not to find >>> gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because the >>> test program for -lgssapi_krb5 links only to gssapi_krb5 but not to gssapi >>> and so gets a lot of errors. I fixed this by adding gssapi, but the final >>> result was the same. >>> >>> harti >>> >> Sorry, forgot to mention you still need that patch to libgssapi and >> libgssapi_krb5 in base that you did previously. The patch to nss_ldap >> alleviates the lingering problems you still saw. I need to eventually >> talk to dfr_at_ (been busy with various projects at home lately) and see how >> nss_ldap should properly link against libgssapi but even after that the >> patch to nss_ldap will still be needed and better than the current method >> used to use a host ticket. > > How will gss allow you to go without a host ticket? Somehow the host > needs to bind to the AD, right? Yes, you still need a host ticket on the box. For nss_ldap to work correctly right now using a host ticket on -CURRENT you need libgssapi_{krb5,spnego} linked against libgssapi and the patch to the nss_ldap port. nss_ldap has two different methods that it can use to use a host ticket and the one used is determined during the configure stage of the port. The port currently uses a host ticket by temporarily changing the path to the user's ticket in the user's environment to the path to the host ticket when it needs to do a lookup. The patch to nss_ldap I sent uses the gss_krb5_ccache_name() function instead on -CURRENT. > In any case I rebuilt the two libraries linking them agains libgssapi > and I can at least log in again. Sendmail dies with signal 11 and after > I removed the link from /tmp/krb5cc_0 to the host creds cron also dies > with signal 11. This is somewhat hard to debug, because it doesn't dump > core. > > Sudo does not work and gives: > > Mar 7 21:23:57 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure > (see text) (unknown mech-code 2529638944 for mech unknown) > Mar 7 21:23:57 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure > (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults) > Mar 7 21:24:27 knopdnsimu13f last message repeated 8 times > Mar 7 21:24:32 knopdnsimu13f sshd[50888]: error: PAM: authentication > error for root from XXXX.dlr.de > Mar 7 21:25:00 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure > (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults) > Mar 7 21:25:00 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure > (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults) > Mar 7 21:26:05 knopdnsimu13f last message repeated 2 times > Mar 7 21:26:05 knopdnsimu13f sudo: nss_ldap: could not search LDAP > server - Server is unavailable > Yes, sudo, sendmail, cron, and a few others will exhibit this behavior -CURRENT at the moment. > The host ticket is fine (I checked) and the server is, of course, > reachable and up. None of the tickets is expired. > > I must admit that I'm lost in this twisted maze of libraries: gss, > nss_ldap, sasl. I can't even grasp how they layer on each other. But if > you come up with patches I'm ready to try them. > > Did I forget to mention that this worked fine for one or two years until > I decided to update my system (this was when I sent the original mail)? Yup, this started when heimdal and gssapi were updated from the ancient versions we used to have. tom -- | tmclaugh at sdf.lonestar.org tmclaugh at FreeBSD.org | | FreeBSD http://www.FreeBSD.org |Received on Sat Mar 07 2009 - 20:18:48 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:43 UTC