From owner-freebsd-current@FreeBSD.ORG Fri Mar 6 21:16:54 2009 Return-Path: Delivered-To: current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 70A34106564A for ; Fri, 6 Mar 2009 21:16:54 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from mail.terabit.net.ua (mail.terabit.net.ua [195.137.202.147]) by mx1.freebsd.org (Postfix) with ESMTP id 082518FC12 for ; Fri, 6 Mar 2009 21:16:53 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from skuns.zoral.com.ua ([91.193.166.194] helo=mail.zoral.com.ua) by mail.terabit.net.ua with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63 (FreeBSD)) (envelope-from ) id 1LfhPX-000Lfz-1F; Fri, 06 Mar 2009 23:16:51 +0200 Received: from deviant.kiev.zoral.com.ua (root@deviant.kiev.zoral.com.ua [10.1.1.148]) by mail.zoral.com.ua (8.14.2/8.14.2) with ESMTP id n26LGoIb041030 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 6 Mar 2009 23:16:50 +0200 (EET) (envelope-from kostikbel@gmail.com) Received: from deviant.kiev.zoral.com.ua (kostik@localhost [127.0.0.1]) by deviant.kiev.zoral.com.ua (8.14.3/8.14.3) with ESMTP id n26LGogf052956; Fri, 6 Mar 2009 23:16:50 +0200 (EET) (envelope-from kostikbel@gmail.com) Received: (from kostik@localhost) by deviant.kiev.zoral.com.ua (8.14.3/8.14.3/Submit) id n26LGoUQ052955; Fri, 6 Mar 2009 23:16:50 +0200 (EET) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: deviant.kiev.zoral.com.ua: kostik set sender to kostikbel@gmail.com using -f Date: Fri, 6 Mar 2009 23:16:50 +0200 From: Kostik Belousov To: Hartmut Brandt Message-ID: <20090306211650.GD41617@deviant.kiev.zoral.com.ua> References: <49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org> <20090306213531.G60465@beagle.kn.op.dlr.de> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="Hr5PwJHywBDnhAYt" Content-Disposition: inline In-Reply-To: <20090306213531.G60465@beagle.kn.op.dlr.de> User-Agent: Mutt/1.4.2.3i X-Virus-Scanned: ClamAV version 0.94.2, clamav-milter version 0.94.2 on skuns.kiev.zoral.com.ua X-Virus-Status: Clean X-Virus-Scanned: mail.terabit.net.ua 1LfhPX-000Lfz-1F 08257a0a999dd9cd65f3d9e061342880 X-Terabit: YES Cc: Tom McLaughlin , kazakov@gmail.com, current@freebsd.org Subject: Re: problem with nss_ldap X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2009 21:16:54 -0000 --Hr5PwJHywBDnhAYt Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Mar 06, 2009 at 09:39:31PM +0100, Hartmut Brandt wrote: >=20 > Hi Tom, >=20 > On Sat, 28 Feb 2009, Tom McLaughlin wrote: >=20 > TM>Tom McLaughlin wrote: > TM>> Harti Brandt wrote: > TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote: > TM> > TM>> > > Both create entries in /var/log/messages like: > TM>> > >=20 > TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error: Miscell= aneous > TM>> > > failure (see > TM>> > > text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZ > TM>Z > TM>> Z > TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ > TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ > TM>> > >=20 > TM>> > > I've tried to figure out in which of the dozens of layered libra= ries > TM>> > > (gss, sasl, ssl, ......) this error is generated but did not find > TM>> > > anything. > TM>> > >=20 > TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in sshd_c= onfig > TM>> > > (as I said, this worked before). > TM>> > So to answer my own mail: I made a link from the kerberos ticket f= ile > TM>> > which contains the host ticket (and is specified in nss_ldap.conf)= to > TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, though. > TM>>=20 > TM>> There may be an issue with the env method used in nss_ldap to change= the > TM>> credentials cache. My mind is fuzzy but I do recall a similar issue= but > TM>> don't remember the exact cause or case. nss_ldap has a second confi= gurable > TM>> ccname method which when I submitted the original patch I intended to > TM>> switch to once we had a newer heimdal. Once I get nss_ldap working = on my > TM>> box I intend to submit another patch. > TM>>=20 > TM>> tom > TM> > TM>Hi Harti (CC maintainer), > TM> > TM>Can you try the attached patch for nss_ldap? This should cause the ho= st > TM>ticket to work correctly on -CURRENT. It's "my box approved". >=20 > Does not work. I rebuilt my system with today's sources to be sure,=20 > removed my patches to the two library makefiles and rebuilt nss_ldap with= =20 > your patch. I get: >=20 > # ls -l > dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol "GSS_C_NT_HOSTB= ASED_SERVICE" > /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol "gs= s_oid_equal" >=20 > Basically on everything I enter. Luckily vi still works :-) >=20 > I saw that the configuration script claims not to find=20 > gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because the=20 > test program for -lgssapi_krb5 links only to gssapi_krb5 but not to gssap= i=20 > and so gets a lot of errors. I fixed this by adding gssapi, but the final= =20 > result was the same. It seems that this is because libgssapi_krb5, libgssapi_spnego and several other heimdal shared libraries are not linked against libgssapi. --Hr5PwJHywBDnhAYt Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (FreeBSD) iEYEARECAAYFAkmxksIACgkQC3+MBN1Mb4hfMQCfUDKMfLcXOc44CAYX2MLMNjFb XXkAnAzo5O6rXLgjt4p3yeAxiRhsZLSz =2jfD -----END PGP SIGNATURE----- --Hr5PwJHywBDnhAYt--