From owner-freebsd-current@FreeBSD.ORG Sat Mar 7 20:53:38 2009 Return-Path: Delivered-To: current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 29E04106566B for ; Sat, 7 Mar 2009 20:53:38 +0000 (UTC) (envelope-from Hartmut.Brandt@dlr.de) Received: from smtp-1.dlr.de (smtp-1.dlr.de [195.37.61.185]) by mx1.freebsd.org (Postfix) with ESMTP id B32DA8FC0A for ; Sat, 7 Mar 2009 20:53:37 +0000 (UTC) (envelope-from Hartmut.Brandt@dlr.de) Received: from [129.247.12.8] ([129.247.12.8]) by smtp-1.dlr.de with Microsoft SMTPSVC(6.0.3790.1830); Sat, 7 Mar 2009 21:53:35 +0100 Message-ID: <49B2DEC6.40508@dlr.de> Date: Sat, 07 Mar 2009 21:53:26 +0100 From: Hartmut Brandt Organization: German Aerospace Center User-Agent: Thunderbird 2.0.0.19 (Windows/20081209) MIME-Version: 1.0 To: tmclaugh@sdf.lonestar.org References: <49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org> <20090306213531.G60465@beagle.kn.op.dlr.de> <16b1f9afed4c6f2c13010f6f281d8a5f.squirrel@webmail.freeshell.org> In-Reply-To: <16b1f9afed4c6f2c13010f6f281d8a5f.squirrel@webmail.freeshell.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 07 Mar 2009 20:53:35.0621 (UTC) FILETIME=[C881F350:01C99F66] Cc: kazakov@gmail.com, current@freebsd.org Subject: Re: problem with nss_ldap X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Mar 2009 20:53:38 -0000 tmclaugh@sdf.lonestar.org wrote: >> Hi Tom, >> >> On Sat, 28 Feb 2009, Tom McLaughlin wrote: >> >> TM>Tom McLaughlin wrote: >> TM>> Harti Brandt wrote: >> TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote: >> TM> >> TM>> > > Both create entries in /var/log/messages like: >> TM>> > > >> TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error: >> Miscellaneous >> TM>> > > failure (see >> TM>> > > >> text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ >> TM>Z >> TM>> Z >> TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ >> TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ >> TM>> > > >> TM>> > > I've tried to figure out in which of the dozens of layered >> libraries >> TM>> > > (gss, sasl, ssl, ......) this error is generated but did not find >> TM>> > > anything. >> TM>> > > >> TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in >> sshd_config >> TM>> > > (as I said, this worked before). >> TM>> > So to answer my own mail: I made a link from the kerberos ticket >> file >> TM>> > which contains the host ticket (and is specified in nss_ldap.conf) >> to >> TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, though. >> TM>> >> TM>> There may be an issue with the env method used in nss_ldap to change >> the >> TM>> credentials cache. My mind is fuzzy but I do recall a similar issue >> but >> TM>> don't remember the exact cause or case. nss_ldap has a second >> configurable >> TM>> ccname method which when I submitted the original patch I intended to >> TM>> switch to once we had a newer heimdal. Once I get nss_ldap working >> on my >> TM>> box I intend to submit another patch. >> TM>> >> TM>> tom >> TM> >> TM>Hi Harti (CC maintainer), >> TM> >> TM>Can you try the attached patch for nss_ldap? This should cause the >> host >> TM>ticket to work correctly on -CURRENT. It's "my box approved". >> >> Does not work. I rebuilt my system with today's sources to be sure, >> removed my patches to the two library makefiles and rebuilt nss_ldap with >> your patch. I get: >> >> # ls -l >> dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol >> "GSS_C_NT_HOSTBASED_SERVICE" >> /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol >> "gss_oid_equal" >> >> Basically on everything I enter. Luckily vi still works :-) >> >> I saw that the configuration script claims not to find >> gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because the >> test program for -lgssapi_krb5 links only to gssapi_krb5 but not to gssapi >> and so gets a lot of errors. I fixed this by adding gssapi, but the final >> result was the same. >> >> harti >> > > Sorry, forgot to mention you still need that patch to libgssapi and > libgssapi_krb5 in base that you did previously. The patch to nss_ldap > alleviates the lingering problems you still saw. I need to eventually > talk to dfr@ (been busy with various projects at home lately) and see how > nss_ldap should properly link against libgssapi but even after that the > patch to nss_ldap will still be needed and better than the current method > used to use a host ticket. How will gss allow you to go without a host ticket? Somehow the host needs to bind to the AD, right? In any case I rebuilt the two libraries linking them agains libgssapi and I can at least log in again. Sendmail dies with signal 11 and after I removed the link from /tmp/krb5cc_0 to the host creds cron also dies with signal 11. This is somewhat hard to debug, because it doesn't dump core. Sudo does not work and gives: Mar 7 21:23:57 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure (see text) (unknown mech-code 2529638944 for mech unknown) Mar 7 21:23:57 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults) Mar 7 21:24:27 knopdnsimu13f last message repeated 8 times Mar 7 21:24:32 knopdnsimu13f sshd[50888]: error: PAM: authentication error for root from XXXX.dlr.de Mar 7 21:25:00 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults) Mar 7 21:25:00 knopdnsimu13f sudo: GSSAPI Error: Miscellaneous failure (see text)¥¥¥¥¥¥¥¥¥¥¥¥¥¥¥ (Ticket expired¥¥libdefaults) Mar 7 21:26:05 knopdnsimu13f last message repeated 2 times Mar 7 21:26:05 knopdnsimu13f sudo: nss_ldap: could not search LDAP server - Server is unavailable The host ticket is fine (I checked) and the server is, of course, reachable and up. None of the tickets is expired. I must admit that I'm lost in this twisted maze of libraries: gss, nss_ldap, sasl. I can't even grasp how they layer on each other. But if you come up with patches I'm ready to try them. Did I forget to mention that this worked fine for one or two years until I decided to update my system (this was when I sent the original mail)? harti