Date: Tue, 10 Mar 2009 13:39:45 +0100 (CET) From: Hartmut Brandt <hartmut.brandt@dlr.de> To: Doug Rabson <dfr@rabson.org> Cc: Kostik Belousov <kostikbel@gmail.com>, tmclaugh@sdf.lonestar.org, kazakov@gmail.com, current@freebsd.org Subject: Re: problem with nss_ldap Message-ID: <20090310133803.M72202@beagle.kn.op.dlr.de> In-Reply-To: <FE4696E5-35E2-45BC-893E-F74CCB5A7F05@rabson.org> References: <E2F5A6372272F744859F67CB11ABC1110507D4@exbe05.intra.dlr.de> <alpine.BSF.1.10.0901231858510.1173@knopdnsimu13l.kn.op.dlr.de> <49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org> <20090306213531.G60465@beagle.kn.op.dlr.de> <20090306211650.GD41617@deviant.kiev.zoral.com.ua> <ea4fb05da7fa78720849158fe0fcb840.squirrel@webmail.freeshell.org> <20090306222433.GF41617@deviant.kiev.zoral.com.ua> <FE4696E5-35E2-45BC-893E-F74CCB5A7F05@rabson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 10 Mar 2009, Doug Rabson wrote: DR> DR>On 6 Mar 2009, at 22:24, Kostik Belousov wrote: DR> DR>> On Fri, Mar 06, 2009 at 05:00:49PM -0500, tmclaugh@sdf.lonestar.org wrote: DR>> > > On Fri, Mar 06, 2009 at 09:39:31PM +0100, Hartmut Brandt wrote: DR>> > > > DR>> > > > Hi Tom, DR>> > > > DR>> > > > On Sat, 28 Feb 2009, Tom McLaughlin wrote: DR>> > > > DR>> > > > TM>Tom McLaughlin wrote: DR>> > > > TM>> Harti Brandt wrote: DR>> > > > TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote: DR>> > > > TM> DR>> > > > TM>> > > Both create entries in /var/log/messages like: DR>> > > > TM>> > > DR>> > > > TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error: DR>> > > > Miscellaneous DR>> > > > TM>> > > failure (see DR>> > > > TM>> > > DR>> > > > text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ DR>> > > > TM>Z DR>> > > > TM>> Z DR>> > > > TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ DR>> > > > TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ DR>> > > > TM>> > > DR>> > > > TM>> > > I've tried to figure out in which of the dozens of layered DR>> > > > libraries DR>> > > > TM>> > > (gss, sasl, ssl, ......) this error is generated but did not DR>> > > > find DR>> > > > TM>> > > anything. DR>> > > > TM>> > > DR>> > > > TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in DR>> > > > sshd_config DR>> > > > TM>> > > (as I said, this worked before). DR>> > > > TM>> > So to answer my own mail: I made a link from the kerberos DR>> > > > ticket DR>> > > > file DR>> > > > TM>> > which contains the host ticket (and is specified in DR>> > > > nss_ldap.conf) to DR>> > > > TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, DR>> > > > though. DR>> > > > TM>> DR>> > > > TM>> There may be an issue with the env method used in nss_ldap to DR>> > > > change the DR>> > > > TM>> credentials cache. My mind is fuzzy but I do recall a similar DR>> > > > issue but DR>> > > > TM>> don't remember the exact cause or case. nss_ldap has a second DR>> > > > configurable DR>> > > > TM>> ccname method which when I submitted the original patch I DR>> > > > intended DR>> > > > to DR>> > > > TM>> switch to once we had a newer heimdal. Once I get nss_ldap DR>> > > > working DR>> > > > on my DR>> > > > TM>> box I intend to submit another patch. DR>> > > > TM>> DR>> > > > TM>> tom DR>> > > > TM> DR>> > > > TM>Hi Harti (CC maintainer), DR>> > > > TM> DR>> > > > TM>Can you try the attached patch for nss_ldap? This should cause DR>> > > > the DR>> > > > host DR>> > > > TM>ticket to work correctly on -CURRENT. It's "my box approved". DR>> > > > DR>> > > > Does not work. I rebuilt my system with today's sources to be sure, DR>> > > > removed my patches to the two library makefiles and rebuilt nss_ldap DR>> > > > with DR>> > > > your patch. I get: DR>> > > > DR>> > > > # ls -l DR>> > > > dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol DR>> > > > "GSS_C_NT_HOSTBASED_SERVICE" DR>> > > > /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol DR>> > > > "gss_oid_equal" DR>> > > > DR>> > > > Basically on everything I enter. Luckily vi still works :-) DR>> > > > DR>> > > > I saw that the configuration script claims not to find DR>> > > > gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because DR>> > > > the DR>> > > > test program for -lgssapi_krb5 links only to gssapi_krb5 but not to DR>> > > > gssapi DR>> > > > and so gets a lot of errors. I fixed this by adding gssapi, but the DR>> > > > final DR>> > > > result was the same. DR>> > > DR>> > > It seems that this is because libgssapi_krb5, libgssapi_spnego DR>> > > and several other heimdal shared libraries are not linked against DR>> > > libgssapi. DR>> > > DR>> > > DR>> > DR>> > As I understand it libgssapi_krb5 and libgssapi_spnego are not supposed DR>> > to DR>> > be linked against libgssapi. They're supposed to be just plugins. DR>> DR>> These objects reference symbols from libgssapi. The libgssapi or nss_ldap DR>> are dlopened without RTLD_GLOBAL flag, and libgssapi-provided symbols DR>> are not available. As I understand, nss module must be not loaded with DR>> RTLD_GLOBAL. DR>> DR>> Our binutils in base are old. Newer ld has a switch DR>> --no-allow-shlib-undefined DR>> that fails the link if shared library has undefined references. I find DR>> it useful to catch and fix this kind of errors. DR> DR> DR>The real problem is that nss_ldap should not link with libgssapi_krb5 DR>directly. This library is a plugin for the mechanism-independant libgssapi DR>and can not be used standalone. The nss_ldap module should link to libgssapi DR>and that will handle loading libgssapi_krb5 as necessary. Is it possible that gssapi_krb5 is needed because nss_ldap needs to set the ticket cache name for the host ticket from the krb5_ccname statement? Just a guess, though? harti
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090310133803.M72202>