Hartmut Brandt wrote: > On Sun, 15 Mar 2009, Tom McLaughlin wrote: > > TM>Hartmut Brandt wrote: > TM>> On Tue, 10 Mar 2009, Tom McLaughlin wrote: > TM>> > TM>> TM>Doug Rabson wrote: > TM>> > TM>> [snip alot] > TM>> > TM>> TM>Okay, attached is a patch to nss_ldap. On -CURRENT I have changed the > TM>> TM>CONFIGURE_ARG to use "--enable-configurable-krb5-ccname-gssapi" instead > TM>> TM>of "--enable-configurable-krb5-ccname-env" which fixes Harti's initial > TM>> TM>problem with apps like cron failing. It will also make nss_ldap link > TM>> TM>against libgssapi and libgssapi_krb5. I still have one lingering issue > TM>> TM>though at least things work. > TM>> TM> > TM>> TM>[tom_at_freebsd-8-amd64 tom]$ getent passwd tom > TM>> TM>dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol > TM>> TM>"GSS_C_NT_HOSTBASED_SERVICE" > TM>> TM>tom:x:10001:10001:Tom McLaughlin:/home/tom:/bin/sh > TM>> > TM>> Ok. This works so far. I get the same error. But I have the original > TM>> problem > TM>> again - cron, sendmail and sshd seem not to use the hostcreds. I still need > TM>> a > TM>> link from /var/tmp/hostcreds to /tmp/krb5cc_0 to make sshd to work. The > TM>> build > TM>> of nss_ldap seems to find all the necessary files: sasl.h, gssapi.h, > TM>> gssapi_krb5.h. > TM>> > TM> > TM>What's the machine's OSVERSION? I used the OSVERSION on my box when checking > TM>which method to use for setting the credentials cache. I didn't feel like > TM>trying to figure out what the OSVERSION was when Heimdal was updated. > > Looks like the Makefile checks for >= 800064. My sys/param.h has 800061. > > Unfortunately I'm out of town until at least sunday so I can do more tests > only next week. > > harti > > TM> > TM>tom > TM> > TM>> The thing I cannot understand is: why do normal applications find the > TM>> hostcreds, > TM>> but the daemons not? What do they differently? > TM>> > TM>> harti > TM> > TM> > TM> > _______________________________________________ > freebsd-current_at_freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-current > To unsubscribe, send any mail to "freebsd-current-unsubscribe_at_freebsd.org" Today I found this posting here having much trouble with authetication on some clients. After an update of the LDAP server from OpenLDAP 2.4.14 to 2.4.15 and updating db-4.6 to db-4.7 (all on the server, server runs FreeBSD 7.1-STABLE/i386), I have no luck log in via ssh on any client (client runs FreeBSD 8.0-CURRENT/amd64). Client has also db-4.7 and OpenLDAP 2.4.15 and I recompiled pam_ldap and nss_ldap when updated OpenLDAP 2.4.14 to OpenLDAP 2.4.15. Checking console log gives me this: Mar 16 11:04:34 thusnelda sshd[1560]: fatal: login_get_lastlog: Cannot find account for uid 1000 Mar 16 11:04:34 thusnelda sshd[1560]: syslogin_perform_logout: logout() returned an error Checking sshd.log gives this:Mar 16 11:04:19 thusnelda sshd[1560]: Accepted keyboard-interactive/pam for user from XXX.XXX.XXX.XXX port 61861 ssh2 Mar 16 11:04:19 thusnelda sshd[1563]: nss_ldap: could not get LDAP result - Can't contact LDAP server Mar 16 11:04:34 thusnelda sshd[1563]: nss_ldap: could not get LDAP result - Timed out Mar 16 11:04:34 thusnelda sshd[1560]: nss_ldap: could not search LDAP server - Server is unavailable Mar 16 11:04:34 thusnelda sshd[1560]: fatal: login_get_lastlog: Cannot find account for uid 1000 Mar 16 11:04:34 thusnelda sshd[1560]: syslogin_perform_logout: logout() returned an error This happens now on all boxes running the most recent OpenLDAP 2.4.15. is there a serious issue we should PR? Thanks in advance, OliverReceived on Mon Mar 16 2009 - 10:37:39 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:44 UTC