From owner-freebsd-current@FreeBSD.ORG Fri Mar 6 20:52:51 2009 Return-Path: Delivered-To: current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8BA4D106567A for ; Fri, 6 Mar 2009 20:52:51 +0000 (UTC) (envelope-from Hartmut.Brandt@dlr.de) Received: from smtp-1.dlr.de (smtp-1.dlr.de [195.37.61.185]) by mx1.freebsd.org (Postfix) with ESMTP id 229FB8FC19 for ; Fri, 6 Mar 2009 20:52:50 +0000 (UTC) (envelope-from Hartmut.Brandt@dlr.de) Received: from beagle.kn.op.dlr.de ([129.247.178.136]) by smtp-1.dlr.de over TLS secured channel with Microsoft SMTPSVC(6.0.3790.1830); Fri, 6 Mar 2009 21:39:33 +0100 Date: Fri, 6 Mar 2009 21:39:31 +0100 (CET) From: Hartmut Brandt X-X-Sender: brandt_h@beagle.kn.op.dlr.de To: Tom McLaughlin In-Reply-To: <49A97F2E.3030005@sdf.lonestar.org> Message-ID: <20090306213531.G60465@beagle.kn.op.dlr.de> References: <49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-OriginalArrivalTime: 06 Mar 2009 20:39:33.0695 (UTC) FILETIME=[A8447CF0:01C99E9B] Cc: kazakov@gmail.com, current@freebsd.org Subject: Re: problem with nss_ldap X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2009 20:52:52 -0000 Hi Tom, On Sat, 28 Feb 2009, Tom McLaughlin wrote: TM>Tom McLaughlin wrote: TM>> Harti Brandt wrote: TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote: TM> TM>> > > Both create entries in /var/log/messages like: TM>> > > TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error: Miscellaneous TM>> > > failure (see TM>> > > text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ TM>Z TM>> Z TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ TM>> > > TM>> > > I've tried to figure out in which of the dozens of layered libraries TM>> > > (gss, sasl, ssl, ......) this error is generated but did not find TM>> > > anything. TM>> > > TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in sshd_config TM>> > > (as I said, this worked before). TM>> > So to answer my own mail: I made a link from the kerberos ticket file TM>> > which contains the host ticket (and is specified in nss_ldap.conf) to TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, though. TM>> TM>> There may be an issue with the env method used in nss_ldap to change the TM>> credentials cache. My mind is fuzzy but I do recall a similar issue but TM>> don't remember the exact cause or case. nss_ldap has a second configurable TM>> ccname method which when I submitted the original patch I intended to TM>> switch to once we had a newer heimdal. Once I get nss_ldap working on my TM>> box I intend to submit another patch. TM>> TM>> tom TM> TM>Hi Harti (CC maintainer), TM> TM>Can you try the attached patch for nss_ldap? This should cause the host TM>ticket to work correctly on -CURRENT. It's "my box approved". Does not work. I rebuilt my system with today's sources to be sure, removed my patches to the two library makefiles and rebuilt nss_ldap with your patch. I get: # ls -l dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol "GSS_C_NT_HOSTBASED_SERVICE" /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol "gss_oid_equal" Basically on everything I enter. Luckily vi still works :-) I saw that the configuration script claims not to find gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because the test program for -lgssapi_krb5 links only to gssapi_krb5 but not to gssapi and so gets a lot of errors. I fixed this by adding gssapi, but the final result was the same. harti