From owner-freebsd-current@FreeBSD.ORG Tue Mar 10 12:47:20 2009 Return-Path: Delivered-To: current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C16F5106564A for ; Tue, 10 Mar 2009 12:47:20 +0000 (UTC) (envelope-from dfr@rabson.org) Received: from itchy.rabson.org (unknown [IPv6:2002:50b1:e8f2:1::143]) by mx1.freebsd.org (Postfix) with ESMTP id C926F8FC25 for ; Tue, 10 Mar 2009 12:47:19 +0000 (UTC) (envelope-from dfr@rabson.org) Received: from [IPv6:2001:470:909f:1:21b:63ff:feb8:5abc] (unknown [IPv6:2001:470:909f:1:21b:63ff:feb8:5abc]) by itchy.rabson.org (Postfix) with ESMTP id 54DF53FB8; Tue, 10 Mar 2009 12:46:00 +0000 (GMT) Message-Id: <04C4F524-8E26-4EAB-B28A-2F87358459A7@rabson.org> From: Doug Rabson To: Hartmut Brandt In-Reply-To: <20090310133803.M72202@beagle.kn.op.dlr.de> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v930.3) Date: Tue, 10 Mar 2009 12:47:17 +0000 References: <49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org> <20090306213531.G60465@beagle.kn.op.dlr.de> <20090306211650.GD41617@deviant.kiev.zoral.com.ua> <20090306222433.GF41617@deviant.kiev.zoral.com.ua> <20090310133803.M72202@beagle.kn.op.dlr.de> X-Mailer: Apple Mail (2.930.3) Cc: Kostik Belousov , tmclaugh@sdf.lonestar.org, kazakov@gmail.com, current@freebsd.org Subject: Re: problem with nss_ldap X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2009 12:47:21 -0000 On 10 Mar 2009, at 12:39, Hartmut Brandt wrote: > On Tue, 10 Mar 2009, Doug Rabson wrote: > > DR> > DR>On 6 Mar 2009, at 22:24, Kostik Belousov wrote: > DR> > DR>> On Fri, Mar 06, 2009 at 05:00:49PM -0500, tmclaugh@sdf.lonestar.org > wrote: > DR>> > > On Fri, Mar 06, 2009 at 09:39:31PM +0100, Hartmut Brandt > wrote: > DR>> > > > > DR>> > > > Hi Tom, > DR>> > > > > DR>> > > > On Sat, 28 Feb 2009, Tom McLaughlin wrote: > DR>> > > > > DR>> > > > TM>Tom McLaughlin wrote: > DR>> > > > TM>> Harti Brandt wrote: > DR>> > > > TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote: > DR>> > > > TM> > DR>> > > > TM>> > > Both create entries in /var/log/messages like: > DR>> > > > TM>> > > > DR>> > > > TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI > Error: > DR>> > > > Miscellaneous > DR>> > > > TM>> > > failure (see > DR>> > > > TM>> > > > DR>> > > > text)??????????????? > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ > DR>> > > > TM>Z > DR>> > > > TM>> Z > DR>> > > > TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ > DR>> > > > TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: > ZZZZZZZZZZZZZZZZ > DR>> > > > TM>> > > > DR>> > > > TM>> > > I've tried to figure out in which of the dozens > of layered > DR>> > > > libraries > DR>> > > > TM>> > > (gss, sasl, ssl, ......) this error is generated > but did not > DR>> > > > find > DR>> > > > TM>> > > anything. > DR>> > > > TM>> > > > DR>> > > > TM>> > > This is on amd64, krb5 enabled in pam, gssapi > disabled in > DR>> > > > sshd_config > DR>> > > > TM>> > > (as I said, this worked before). > DR>> > > > TM>> > So to answer my own mail: I made a link from the > kerberos > DR>> > > > ticket > DR>> > > > file > DR>> > > > TM>> > which contains the host ticket (and is specified in > DR>> > > > nss_ldap.conf) to > DR>> > > > TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly > necessary, > DR>> > > > though. > DR>> > > > TM>> > DR>> > > > TM>> There may be an issue with the env method used in > nss_ldap to > DR>> > > > change the > DR>> > > > TM>> credentials cache. My mind is fuzzy but I do recall > a similar > DR>> > > > issue but > DR>> > > > TM>> don't remember the exact cause or case. nss_ldap > has a second > DR>> > > > configurable > DR>> > > > TM>> ccname method which when I submitted the original > patch I > DR>> > > > intended > DR>> > > > to > DR>> > > > TM>> switch to once we had a newer heimdal. Once I get > nss_ldap > DR>> > > > working > DR>> > > > on my > DR>> > > > TM>> box I intend to submit another patch. > DR>> > > > TM>> > DR>> > > > TM>> tom > DR>> > > > TM> > DR>> > > > TM>Hi Harti (CC maintainer), > DR>> > > > TM> > DR>> > > > TM>Can you try the attached patch for nss_ldap? This > should cause > DR>> > > > the > DR>> > > > host > DR>> > > > TM>ticket to work correctly on -CURRENT. It's "my box > approved". > DR>> > > > > DR>> > > > Does not work. I rebuilt my system with today's sources > to be sure, > DR>> > > > removed my patches to the two library makefiles and > rebuilt nss_ldap > DR>> > > > with > DR>> > > > your patch. I get: > DR>> > > > > DR>> > > > # ls -l > DR>> > > > dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol > DR>> > > > "GSS_C_NT_HOSTBASED_SERVICE" > DR>> > > > /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: > Undefined symbol > DR>> > > > "gss_oid_equal" > DR>> > > > > DR>> > > > Basically on everything I enter. Luckily vi still works :-) > DR>> > > > > DR>> > > > I saw that the configuration script claims not to find > DR>> > > > gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This > is because > DR>> > > > the > DR>> > > > test program for -lgssapi_krb5 links only to gssapi_krb5 > but not to > DR>> > > > gssapi > DR>> > > > and so gets a lot of errors. I fixed this by adding > gssapi, but the > DR>> > > > final > DR>> > > > result was the same. > DR>> > > > DR>> > > It seems that this is because libgssapi_krb5, > libgssapi_spnego > DR>> > > and several other heimdal shared libraries are not linked > against > DR>> > > libgssapi. > DR>> > > > DR>> > > > DR>> > > DR>> > As I understand it libgssapi_krb5 and libgssapi_spnego are > not supposed > DR>> > to > DR>> > be linked against libgssapi. They're supposed to be just > plugins. > DR>> > DR>> These objects reference symbols from libgssapi. The libgssapi > or nss_ldap > DR>> are dlopened without RTLD_GLOBAL flag, and libgssapi-provided > symbols > DR>> are not available. As I understand, nss module must be not > loaded with > DR>> RTLD_GLOBAL. > DR>> > DR>> Our binutils in base are old. Newer ld has a switch > DR>> --no-allow-shlib-undefined > DR>> that fails the link if shared library has undefined references. > I find > DR>> it useful to catch and fix this kind of errors. > DR> > DR> > DR>The real problem is that nss_ldap should not link with > libgssapi_krb5 > DR>directly. This library is a plugin for the mechanism-independant > libgssapi > DR>and can not be used standalone. The nss_ldap module should link > to libgssapi > DR>and that will handle loading libgssapi_krb5 as necessary. > > Is it possible that gssapi_krb5 is needed because nss_ldap needs to > set > the ticket cache name for the host ticket from the krb5_ccname > statement? > > Just a guess, though? Possibly. This library does export symbols for kerberos-specific GSS- API extensions but if you use them you still need to link with libgssapi as well.