problem with nss_ldap

Tue Mar 10 05:47:21 PDT 2009

On 10 Mar 2009, at 12:39, Hartmut Brandt wrote:

> On Tue, 10 Mar 2009, Doug Rabson wrote:
>
> DR>
> DR>On 6 Mar 2009, at 22:24, Kostik Belousov wrote:
> DR>
> DR>> On Fri, Mar 06, 2009 at 05:00:49PM -0500, tmclaugh at sdf.lonestar.org 
>  wrote:
> DR>> > > On Fri, Mar 06, 2009 at 09:39:31PM +0100, Hartmut Brandt  
> wrote:
> DR>> > > >
> DR>> > > > Hi Tom,
> DR>> > > >
> DR>> > > > On Sat, 28 Feb 2009, Tom McLaughlin wrote:
> DR>> > > >
> DR>> > > > TM>Tom McLaughlin wrote:
> DR>> > > > TM>> Harti Brandt wrote:
> DR>> > > > TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt at dlr.de wrote:
> DR>> > > > TM>
> DR>> > > > TM>> > > Both create entries in /var/log/messages like:
> DR>> > > > TM>> > >
> DR>> > > > TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI  
> Error:
> DR>> > > > Miscellaneous
> DR>> > > > TM>> > > failure (see
> DR>> > > > TM>> > >
> DR>> > > > text)??????????????? 
> ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
> DR>> > > > TM>Z
> DR>> > > > TM>> Z
> DR>> > > > TM>> >  ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
> DR>> > > > TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel:  
> ZZZZZZZZZZZZZZZZ
> DR>> > > > TM>> > >
> DR>> > > > TM>> > > I've tried to figure out in which of the dozens  
> of layered
> DR>> > > > libraries
> DR>> > > > TM>> > > (gss, sasl, ssl, ......) this error is generated  
> but did not
> DR>> > > > find
> DR>> > > > TM>> > > anything.
> DR>> > > > TM>> > >
> DR>> > > > TM>> > > This is on amd64, krb5 enabled in pam, gssapi  
> disabled in
> DR>> > > > sshd_config
> DR>> > > > TM>> > > (as I said, this worked before).
> DR>> > > > TM>> > So to answer my own mail: I made a link from the  
> kerberos
> DR>> > > > ticket
> DR>> > > > file
> DR>> > > > TM>> > which contains the host ticket (and is specified in
> DR>> > > > nss_ldap.conf) to
> DR>> > > > TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly  
> necessary,
> DR>> > > > though.
> DR>> > > > TM>>
> DR>> > > > TM>> There may be an issue with the env method used in  
> nss_ldap to
> DR>> > > > change the
> DR>> > > > TM>> credentials cache.  My mind is fuzzy but I do recall  
> a similar
> DR>> > > > issue but
> DR>> > > > TM>> don't remember the exact cause or case.  nss_ldap  
> has a second
> DR>> > > > configurable
> DR>> > > > TM>> ccname method which when I submitted the original  
> patch I
> DR>> > > > intended
> DR>> > > > to
> DR>> > > > TM>> switch to once we had a newer heimdal.  Once I get  
> nss_ldap
> DR>> > > > working
> DR>> > > > on my
> DR>> > > > TM>> box I intend to submit another patch.
> DR>> > > > TM>>
> DR>> > > > TM>> tom
> DR>> > > > TM>
> DR>> > > > TM>Hi Harti (CC maintainer),
> DR>> > > > TM>
> DR>> > > > TM>Can you try the attached patch for nss_ldap?  This  
> should cause
> DR>> > > > the
> DR>> > > > host
> DR>> > > > TM>ticket to work correctly on -CURRENT.  It's "my box  
> approved".
> DR>> > > >
> DR>> > > > Does not work. I rebuilt my system with today's sources  
> to be sure,
> DR>> > > > removed my patches to the two library makefiles and  
> rebuilt nss_ldap
> DR>> > > > with
> DR>> > > > your patch. I get:
> DR>> > > >
> DR>> > > > # ls -l
> DR>> > > > dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol
> DR>> > > > "GSS_C_NT_HOSTBASED_SERVICE"
> DR>> > > > /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10:  
> Undefined symbol
> DR>> > > > "gss_oid_equal"
> DR>> > > >
> DR>> > > > Basically on everything I enter. Luckily vi still works :-)
> DR>> > > >
> DR>> > > > I saw that the configuration script claims not to find
> DR>> > > > gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This  
> is because
> DR>> > > > the
> DR>> > > > test program for -lgssapi_krb5 links only to gssapi_krb5  
> but not to
> DR>> > > > gssapi
> DR>> > > > and so gets a lot of errors. I fixed this by adding  
> gssapi, but the
> DR>> > > > final
> DR>> > > > result was the same.
> DR>> > >
> DR>> > > It seems that this is because libgssapi_krb5,  
> libgssapi_spnego
> DR>> > > and several other heimdal shared libraries are not linked  
> against
> DR>> > > libgssapi.
> DR>> > >
> DR>> > >
> DR>> >
> DR>> > As I understand it libgssapi_krb5 and libgssapi_spnego are  
> not supposed
> DR>> > to
> DR>> > be linked against libgssapi.  They're supposed to be just  
> plugins.
> DR>>
> DR>> These objects reference symbols from libgssapi. The libgssapi  
> or nss_ldap
> DR>> are dlopened without RTLD_GLOBAL flag, and libgssapi-provided  
> symbols
> DR>> are not available. As I understand, nss module must be not  
> loaded with
> DR>> RTLD_GLOBAL.
> DR>>
> DR>> Our binutils in base are old. Newer ld has a switch
> DR>> --no-allow-shlib-undefined
> DR>> that fails the link if shared library has undefined references.  
> I find
> DR>> it useful to catch and fix this kind of errors.
> DR>
> DR>
> DR>The real problem is that nss_ldap should not link with  
> libgssapi_krb5
> DR>directly. This library is a plugin for the mechanism-independant  
> libgssapi
> DR>and can not be used standalone. The nss_ldap module should link  
> to libgssapi
> DR>and that will handle loading libgssapi_krb5 as necessary.
>
> Is it possible that gssapi_krb5 is needed because nss_ldap needs to  
> set
> the ticket cache name for the host ticket from the krb5_ccname  
> statement?
>
> Just a guess, though?

Possibly. This library does export symbols for kerberos-specific GSS- 
API extensions but if you use them you still need to link with  
libgssapi as well.