From owner-freebsd-current@FreeBSD.ORG Sat Mar 7 21:18:48 2009 Return-Path: Delivered-To: current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E79321065672 for ; Sat, 7 Mar 2009 21:18:48 +0000 (UTC) (envelope-from tmclaugh@sdf.lonestar.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id CA3698FC15; Sat, 7 Mar 2009 21:18:48 +0000 (UTC) (envelope-from tmclaugh@sdf.lonestar.org) Received: from straycat.dhs.org (root@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n27LIlZj051889; Sat, 7 Mar 2009 21:18:48 GMT (envelope-from tmclaugh@sdf.lonestar.org) Received: from tomcat.straycat.dhs.org (tomcat.straycat.dhs.org [192.168.3.130]) by straycat.dhs.org (8.14.1/8.14.1) with ESMTP id n27LIeed018566; Sat, 7 Mar 2009 16:18:41 -0500 (EST) Message-ID: <49B2E4AB.7020604@sdf.lonestar.org> Date: Sat, 07 Mar 2009 16:18:35 -0500 From: Tom McLaughlin User-Agent: Thunderbird 2.0.0.19 (X11/20090105) MIME-Version: 1.0 To: Hartmut Brandt References: <49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org> <20090306213531.G60465@beagle.kn.op.dlr.de> <16b1f9afed4c6f2c13010f6f281d8a5f.squirrel@webmail.freeshell.org> <49B2DEC6.40508@dlr.de> In-Reply-To: <49B2DEC6.40508@dlr.de> X-Enigmail-Version: 0.95.6 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Cc: kazakov@gmail.com, current@freebsd.org Subject: Re: problem with nss_ldap X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Mar 2009 21:18:49 -0000 Hartmut Brandt wrote: > tmclaugh@sdf.lonestar.org wrote: >>> Hi Tom, >>> >>> On Sat, 28 Feb 2009, Tom McLaughlin wrote: >>> >>> TM>Tom McLaughlin wrote: >>> TM>> Harti Brandt wrote: >>> TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote: >>> TM> >>> TM>> > > Both create entries in /var/log/messages like: >>> TM>> > > >>> TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error: >>> Miscellaneous >>> TM>> > > failure (see >>> TM>> > > >>> text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ >>> TM>Z >>> TM>> Z >>> TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ >>> TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ >>> TM>> > > >>> TM>> > > I've tried to figure out in which of the dozens of layered >>> libraries >>> TM>> > > (gss, sasl, ssl, ......) this error is generated but did not find >>> TM>> > > anything. >>> TM>> > > >>> TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in >>> sshd_config >>> TM>> > > (as I said, this worked before). >>> TM>> > So to answer my own mail: I made a link from the kerberos ticket >>> file >>> TM>> > which contains the host ticket (and is specified in nss_ldap.conf) >>> to >>> TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, though. >>> TM>> >>> TM>> There may be an issue with the env method used in nss_ldap to change >>> the >>> TM>> credentials cache. My mind is fuzzy but I do recall a similar issue >>> but >>> TM>> don't remember the exact cause or case. nss_ldap has a second >>> configurable >>> TM>> ccname method which when I submitted the original patch I intended to >>> TM>> switch to once we had a newer heimdal. Once I get nss_ldap working >>> on my >>> TM>> box I intend to submit another patch. >>> TM>> >>> TM>> tom >>> TM> >>> TM>Hi Harti (CC maintainer), >>> TM> >>> TM>Can you try the attached patch for nss_ldap? This should cause the >>> host >>> TM>ticket to work correctly on -CURRENT. It's "my box approved". >>> >>> Does not work. I rebuilt my system with today's sources to be sure, >>> removed my patches to the two library makefiles and rebuilt nss_ldap with >>> your patch. I get: >>> >>> # ls -l >>> dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol >>> "GSS_C_NT_HOSTBASED_SERVICE" >>> /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol >>> "gss_oid_equal" >>> >>> Basically on everything I enter. Luckily vi still works :-) >>> >>> I saw that the configuration script claims not to find >>> gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because the >>> test program for -lgssapi_krb5 links only to gssapi_krb5 but not to gssapi >>> and so gets a lot of errors. I fixed this by adding gssapi, but the final >>> result was the same. >>> >>> harti >>> >> Sorry, forgot to mention you still need that patch to libgssapi and >> libgssapi_krb5 in base that you did previously. The patch to nss_ldap >> alleviates the lingering problems you still saw. I need to eventually >> talk to dfr@ (been busy with various projects at home lately) and see how >> nss_ldap should properly link against libgssapi but even after that the >> patch to nss_ldap will still be needed and better than the current method >> used to use a host ticket. > > How will gss allow you to go without a host ticket? Somehow the host > needs to bind to the AD, right? Yes, you still need a host ticket on the box. For nss_ldap to work correctly right now using a host ticket on -CURRENT you need libgssapi_{krb5,spnego} linked against libgssapi and the patch to the nss_ldap port. nss_ldap has two different methods that it can use to use a host ticket and the one used is determined during the configure stage of the port. The port currently uses a host ticket by temporarily changing the path to the user's ticket in the user's environment to the path to the host ticket when it needs to do a lookup. The patch to nss_ldap I sent uses the gss_krb5_ccache_name() function instead on -CURRENT. > In any case I rebuilt the two libraries linking them agains libgssapi > and I can at least log in again. Sendmail dies with signal 11 and after > I removed the link from /tmp/krb5cc_0 to the host creds cron also dies > with signal 11. This is somewhat hard to debug, because it doesn't dump > core. > > Sudo does not work and gives: > > Mar 7 21:23:57 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure > (see text) (unknown mech-code 2529638944 for mech unknown) > Mar 7 21:23:57 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure > (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults) > Mar 7 21:24:27 knopdnsimu13f last message repeated 8 times > Mar 7 21:24:32 knopdnsimu13f sshd[50888]: error: PAM: authentication > error for root from XXXX.dlr.de > Mar 7 21:25:00 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure > (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults) > Mar 7 21:25:00 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure > (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults) > Mar 7 21:26:05 knopdnsimu13f last message repeated 2 times > Mar 7 21:26:05 knopdnsimu13f sudo: nss_ldap: could not search LDAP > server - Server is unavailable > Yes, sudo, sendmail, cron, and a few others will exhibit this behavior -CURRENT at the moment. > The host ticket is fine (I checked) and the server is, of course, > reachable and up. None of the tickets is expired. > > I must admit that I'm lost in this twisted maze of libraries: gss, > nss_ldap, sasl. I can't even grasp how they layer on each other. But if > you come up with patches I'm ready to try them. > > Did I forget to mention that this worked fine for one or two years until > I decided to update my system (this was when I sent the original mail)? Yup, this started when heimdal and gssapi were updated from the ancient versions we used to have. tom -- | tmclaugh at sdf.lonestar.org tmclaugh at FreeBSD.org | | FreeBSD http://www.FreeBSD.org |