Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 16 Mar 2009 11:10:07 +0000
From:      "O. Hartmann" <ohartman@zedat.fu-berlin.de>
To:        Hartmut Brandt <hartmut.brandt@dlr.de>
Cc:        Kostik Belousov <kostikbel@gmail.com>, Tom McLaughlin <tmclaugh@sdf.lonestar.org>, kazakov@gmail.com, current@freebsd.org
Subject:   Re: problem with nss_ldap
Message-ID:  <49BE338F.1070301@zedat.fu-berlin.de>
In-Reply-To: <20090316093602.O92264@beagle.kn.op.dlr.de>
References:  <E2F5A6372272F744859F67CB11ABC1110507D4@exbe05.intra.dlr.de>	<alpine.BSF.1.10.0901231858510.1173@knopdnsimu13l.kn.op.dlr.de>	<49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org>	<20090306213531.G60465@beagle.kn.op.dlr.de>	<20090306211650.GD41617@deviant.kiev.zoral.com.ua>	<ea4fb05da7fa78720849158fe0fcb840.squirrel@webmail.freeshell.org>	<20090306222433.GF41617@deviant.kiev.zoral.com.ua>	<FE4696E5-35E2-45BC-893E-F74CCB5A7F05@rabson.org>	<20090310114131.GD41617@deviant.kiev.zoral.com.ua>	<70D16F57-F7E3-4CDA-BCD5-5D79B566510B@rabson.org>	<49B69C36.3010307@sdf.lonestar.org>	<20090312092235.F78834@beagle.kn.op.dlr.de>	<49BD8A23.4090909@sdf.lonestar.org> <20090316093602.O92264@beagle.kn.op.dlr.de>

next in thread | previous in thread | raw e-mail | index | archive | help
Hartmut Brandt wrote:
> On Sun, 15 Mar 2009, Tom McLaughlin wrote:
> 
> TM>Hartmut Brandt wrote:
> TM>> On Tue, 10 Mar 2009, Tom McLaughlin wrote:
> TM>> 
> TM>> TM>Doug Rabson wrote:
> TM>> 
> TM>> [snip alot]
> TM>> 
> TM>> TM>Okay, attached is a patch to nss_ldap.  On -CURRENT I have changed the
> TM>> TM>CONFIGURE_ARG to use "--enable-configurable-krb5-ccname-gssapi" instead
> TM>> TM>of "--enable-configurable-krb5-ccname-env" which fixes Harti's initial
> TM>> TM>problem with apps like cron failing.  It will also make nss_ldap link
> TM>> TM>against libgssapi and libgssapi_krb5.  I still have one lingering issue
> TM>> TM>though at least things work.
> TM>> TM>
> TM>> TM>[tom@freebsd-8-amd64 tom]$ getent passwd tom
> TM>> TM>dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol
> TM>> TM>"GSS_C_NT_HOSTBASED_SERVICE"
> TM>> TM>tom:x:10001:10001:Tom McLaughlin:/home/tom:/bin/sh
> TM>> 
> TM>> Ok. This works so far. I get the same error. But I have the original
> TM>> problem
> TM>> again - cron, sendmail and sshd seem not to use the hostcreds. I still need
> TM>> a
> TM>> link from /var/tmp/hostcreds to /tmp/krb5cc_0 to make sshd to work. The
> TM>> build
> TM>> of nss_ldap seems to find all the necessary files: sasl.h, gssapi.h,
> TM>> gssapi_krb5.h.
> TM>> 
> TM>
> TM>What's the machine's OSVERSION?  I used the OSVERSION on my box when checking
> TM>which method to use for setting the credentials cache.  I didn't feel like
> TM>trying to figure out what the OSVERSION was when Heimdal was updated.
> 
> Looks like the Makefile checks for >= 800064. My sys/param.h has 800061.
> 
> Unfortunately I'm out of town until at least sunday so I can do more tests 
> only next week.
> 
> harti
> 
> TM>
> TM>tom
> TM>
> TM>> The thing I cannot understand is: why do normal applications find the
> TM>> hostcreds,
> TM>> but the daemons not? What do they differently?
> TM>> 
> TM>> harti
> TM>
> TM>
> TM>
> _______________________________________________
> freebsd-current@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"

Today I found this posting here having much trouble with authetication 
on some clients.

After an update of the LDAP server from OpenLDAP 2.4.14 to 2.4.15 and 
updating db-4.6 to db-4.7 (all on the server, server runs FreeBSD 
7.1-STABLE/i386), I have no luck log in via ssh on any client (client 
runs FreeBSD 8.0-CURRENT/amd64). Client has also db-4.7 and OpenLDAP 
2.4.15 and I recompiled pam_ldap and nss_ldap when updated OpenLDAP 
2.4.14 to OpenLDAP 2.4.15.

Checking console log gives me this:

Mar 16 11:04:34 thusnelda sshd[1560]: fatal: login_get_lastlog: Cannot 
find account for uid 1000
Mar 16 11:04:34 thusnelda sshd[1560]: syslogin_perform_logout: logout() 
returned an error


Checking sshd.log gives this:Mar 16 11:04:19 thusnelda sshd[1560]: 
Accepted keyboard-interactive/pam for user from XXX.XXX.XXX.XXX port 
61861 ssh2
Mar 16 11:04:19 thusnelda sshd[1563]: nss_ldap: could not get LDAP 
result - Can't contact LDAP server
Mar 16 11:04:34 thusnelda sshd[1563]: nss_ldap: could not get LDAP 
result - Timed out
Mar 16 11:04:34 thusnelda sshd[1560]: nss_ldap: could not search LDAP 
server - Server is unavailable
Mar 16 11:04:34 thusnelda sshd[1560]: fatal: login_get_lastlog: Cannot 
find account for uid 1000
Mar 16 11:04:34 thusnelda sshd[1560]: syslogin_perform_logout: logout() 
returned an error

This happens now on all boxes running the most recent OpenLDAP 2.4.15.

is there a serious issue we should PR?

Thanks in advance,
Oliver



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?49BE338F.1070301>