Date: Sat, 07 Mar 2009 16:18:35 -0500 From: Tom McLaughlin <tmclaugh@sdf.lonestar.org> To: Hartmut Brandt <hartmut.brandt@dlr.de> Cc: kazakov@gmail.com, current@freebsd.org Subject: Re: problem with nss_ldap Message-ID: <49B2E4AB.7020604@sdf.lonestar.org> In-Reply-To: <49B2DEC6.40508@dlr.de> References: <E2F5A6372272F744859F67CB11ABC1110507D4@exbe05.intra.dlr.de> <alpine.BSF.1.10.0901231858510.1173@knopdnsimu13l.kn.op.dlr.de> <49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org> <20090306213531.G60465@beagle.kn.op.dlr.de> <16b1f9afed4c6f2c13010f6f281d8a5f.squirrel@webmail.freeshell.org> <49B2DEC6.40508@dlr.de>
next in thread | previous in thread | raw e-mail | index | archive | help
Hartmut Brandt wrote:
> tmclaugh@sdf.lonestar.org wrote:
>>> Hi Tom,
>>>
>>> On Sat, 28 Feb 2009, Tom McLaughlin wrote:
>>>
>>> TM>Tom McLaughlin wrote:
>>> TM>> Harti Brandt wrote:
>>> TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote:
>>> TM>
>>> TM>> > > Both create entries in /var/log/messages like:
>>> TM>> > >
>>> TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error:
>>> Miscellaneous
>>> TM>> > > failure (see
>>> TM>> > >
>>> text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
>>> TM>Z
>>> TM>> Z
>>> TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
>>> TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ
>>> TM>> > >
>>> TM>> > > I've tried to figure out in which of the dozens of layered
>>> libraries
>>> TM>> > > (gss, sasl, ssl, ......) this error is generated but did not find
>>> TM>> > > anything.
>>> TM>> > >
>>> TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in
>>> sshd_config
>>> TM>> > > (as I said, this worked before).
>>> TM>> > So to answer my own mail: I made a link from the kerberos ticket
>>> file
>>> TM>> > which contains the host ticket (and is specified in nss_ldap.conf)
>>> to
>>> TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, though.
>>> TM>>
>>> TM>> There may be an issue with the env method used in nss_ldap to change
>>> the
>>> TM>> credentials cache. My mind is fuzzy but I do recall a similar issue
>>> but
>>> TM>> don't remember the exact cause or case. nss_ldap has a second
>>> configurable
>>> TM>> ccname method which when I submitted the original patch I intended to
>>> TM>> switch to once we had a newer heimdal. Once I get nss_ldap working
>>> on my
>>> TM>> box I intend to submit another patch.
>>> TM>>
>>> TM>> tom
>>> TM>
>>> TM>Hi Harti (CC maintainer),
>>> TM>
>>> TM>Can you try the attached patch for nss_ldap? This should cause the
>>> host
>>> TM>ticket to work correctly on -CURRENT. It's "my box approved".
>>>
>>> Does not work. I rebuilt my system with today's sources to be sure,
>>> removed my patches to the two library makefiles and rebuilt nss_ldap with
>>> your patch. I get:
>>>
>>> # ls -l
>>> dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol
>>> "GSS_C_NT_HOSTBASED_SERVICE"
>>> /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol
>>> "gss_oid_equal"
>>>
>>> Basically on everything I enter. Luckily vi still works :-)
>>>
>>> I saw that the configuration script claims not to find
>>> gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because the
>>> test program for -lgssapi_krb5 links only to gssapi_krb5 but not to gssapi
>>> and so gets a lot of errors. I fixed this by adding gssapi, but the final
>>> result was the same.
>>>
>>> harti
>>>
>> Sorry, forgot to mention you still need that patch to libgssapi and
>> libgssapi_krb5 in base that you did previously. The patch to nss_ldap
>> alleviates the lingering problems you still saw. I need to eventually
>> talk to dfr@ (been busy with various projects at home lately) and see how
>> nss_ldap should properly link against libgssapi but even after that the
>> patch to nss_ldap will still be needed and better than the current method
>> used to use a host ticket.
>
> How will gss allow you to go without a host ticket? Somehow the host
> needs to bind to the AD, right?
Yes, you still need a host ticket on the box. For nss_ldap to work
correctly right now using a host ticket on -CURRENT you need
libgssapi_{krb5,spnego} linked against libgssapi and the patch to the
nss_ldap port. nss_ldap has two different methods that it can use to
use a host ticket and the one used is determined during the configure
stage of the port. The port currently uses a host ticket by temporarily
changing the path to the user's ticket in the user's environment to the
path to the host ticket when it needs to do a lookup. The patch to
nss_ldap I sent uses the gss_krb5_ccache_name() function instead on
-CURRENT.
> In any case I rebuilt the two libraries linking them agains libgssapi
> and I can at least log in again. Sendmail dies with signal 11 and after
> I removed the link from /tmp/krb5cc_0 to the host creds cron also dies
> with signal 11. This is somewhat hard to debug, because it doesn't dump
> core.
>
> Sudo does not work and gives:
>
> Mar 7 21:23:57 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure
> (see text) (unknown mech-code 2529638944 for mech unknown)
> Mar 7 21:23:57 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure
> (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults)
> Mar 7 21:24:27 knopdnsimu13f last message repeated 8 times
> Mar 7 21:24:32 knopdnsimu13f sshd[50888]: error: PAM: authentication
> error for root from XXXX.dlr.de
> Mar 7 21:25:00 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure
> (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults)
> Mar 7 21:25:00 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure
> (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults)
> Mar 7 21:26:05 knopdnsimu13f last message repeated 2 times
> Mar 7 21:26:05 knopdnsimu13f sudo: nss_ldap: could not search LDAP
> server - Server is unavailable
>
Yes, sudo, sendmail, cron, and a few others will exhibit this behavior
-CURRENT at the moment.
> The host ticket is fine (I checked) and the server is, of course,
> reachable and up. None of the tickets is expired.
>
> I must admit that I'm lost in this twisted maze of libraries: gss,
> nss_ldap, sasl. I can't even grasp how they layer on each other. But if
> you come up with patches I'm ready to try them.
>
> Did I forget to mention that this worked fine for one or two years until
> I decided to update my system (this was when I sent the original mail)?
Yup, this started when heimdal and gssapi were updated from the ancient
versions we used to have.
tom
--
| tmclaugh at sdf.lonestar.org tmclaugh at FreeBSD.org |
| FreeBSD http://www.FreeBSD.org |
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?49B2E4AB.7020604>