From owner-freebsd-current@FreeBSD.ORG Fri Mar 6 21:45:35 2009 Return-Path: Delivered-To: current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DEED5106566C for ; Fri, 6 Mar 2009 21:45:35 +0000 (UTC) (envelope-from tmclaugh@sdf.lonestar.org) Received: from sdf.lonestar.org (mx.freeshell.org [192.94.73.19]) by mx1.freebsd.org (Postfix) with ESMTP id 875438FC08 for ; Fri, 6 Mar 2009 21:45:35 +0000 (UTC) (envelope-from tmclaugh@sdf.lonestar.org) Received: from webmail.freeshell.org (IDENT:nobody@mx.freeshell.org [192.94.73.19]) by sdf.lonestar.org (8.14.3/8.13.8) with ESMTP id n26LXilc026454; Fri, 6 Mar 2009 21:33:45 GMT Received: from w.meditech.com ([208.206.3.254]) (SquirrelMail authenticated user tmclaugh) by webmail.freeshell.org with HTTP; Fri, 6 Mar 2009 16:33:46 -0500 (EST) Message-ID: <16b1f9afed4c6f2c13010f6f281d8a5f.squirrel@webmail.freeshell.org> In-Reply-To: <20090306213531.G60465@beagle.kn.op.dlr.de> References: <49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org> <20090306213531.G60465@beagle.kn.op.dlr.de> Date: Fri, 6 Mar 2009 16:33:46 -0500 (EST) From: tmclaugh@sdf.lonestar.org To: "Hartmut Brandt" User-Agent: SquirrelMail/1.4.17 MIME-Version: 1.0 Content-Type: text/plain;charset=UTF-8 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal Cc: Tom McLaughlin , kazakov@gmail.com, current@freebsd.org Subject: Re: problem with nss_ldap X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2009 21:45:36 -0000 > > Hi Tom, > > On Sat, 28 Feb 2009, Tom McLaughlin wrote: > > TM>Tom McLaughlin wrote: > TM>> Harti Brandt wrote: > TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote: > TM> > TM>> > > Both create entries in /var/log/messages like: > TM>> > > > TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error: > Miscellaneous > TM>> > > failure (see > TM>> > > > text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ > TM>Z > TM>> Z > TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ > TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ > TM>> > > > TM>> > > I've tried to figure out in which of the dozens of layered > libraries > TM>> > > (gss, sasl, ssl, ......) this error is generated but did not find > TM>> > > anything. > TM>> > > > TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in > sshd_config > TM>> > > (as I said, this worked before). > TM>> > So to answer my own mail: I made a link from the kerberos ticket > file > TM>> > which contains the host ticket (and is specified in nss_ldap.conf) > to > TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, though. > TM>> > TM>> There may be an issue with the env method used in nss_ldap to change > the > TM>> credentials cache. My mind is fuzzy but I do recall a similar issue > but > TM>> don't remember the exact cause or case. nss_ldap has a second > configurable > TM>> ccname method which when I submitted the original patch I intended to > TM>> switch to once we had a newer heimdal. Once I get nss_ldap working > on my > TM>> box I intend to submit another patch. > TM>> > TM>> tom > TM> > TM>Hi Harti (CC maintainer), > TM> > TM>Can you try the attached patch for nss_ldap? This should cause the > host > TM>ticket to work correctly on -CURRENT. It's "my box approved". > > Does not work. I rebuilt my system with today's sources to be sure, > removed my patches to the two library makefiles and rebuilt nss_ldap with > your patch. I get: > > # ls -l > dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol > "GSS_C_NT_HOSTBASED_SERVICE" > /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol > "gss_oid_equal" > > Basically on everything I enter. Luckily vi still works :-) > > I saw that the configuration script claims not to find > gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because the > test program for -lgssapi_krb5 links only to gssapi_krb5 but not to gssapi > and so gets a lot of errors. I fixed this by adding gssapi, but the final > result was the same. > > harti > Sorry, forgot to mention you still need that patch to libgssapi and libgssapi_krb5 in base that you did previously. The patch to nss_ldap alleviates the lingering problems you still saw. I need to eventually talk to dfr@ (been busy with various projects at home lately) and see how nss_ldap should properly link against libgssapi but even after that the patch to nss_ldap will still be needed and better than the current method used to use a host ticket. tom