On Sat, May 7, 2011 at 11:14 AM, Stéphane Gaudreault
<stephane@archlinux.org> wrote:
> * Replace heimdal by the MIT Kerberos implementation, krb5
> * Rebuilded [core] packages :
> *- librpcsecgss
> *- libtirpc
> *- nfs-utils
> *- openssh
>
> Please signoff both.
> Thanks
>
> Stéphane
I see a regression versus heimdal here. Do this:
1. Set up krb5.conf to enable proxiable and forwardable tickets
2. Set up ~/.ssh/config to enable "GSSAPIAuthentication" and
"GSSAPIDelegateCredentials"
3. Use "kinit" from this krb5 package to get a new TGT
4. Use the ssh client from this openssh rebuild to connect to a server
that support GSSAPI auth
On some, but not all, ssh server implementations, GSSAPI auth will
fail, and it will fall back to password auth. The server will log
this:
sshd[3822]: Forcing password authentication because no credentials delegated
When using the heimdal-based builds, GSSAPI auth would work in all cases.
It's entirely likely that only very old ssh servers show this problem,
as that's what I'm seeing so far. Possibly there is some confusion
with the new "Okay as delegate" ticket flag, which heimdal didn't
support at all, and MIT krb5 only supports enough to parse and report,
but has no support for setting.
I don't consider this important enough to block the release of these
packages, but I wanted to mention it in case someone else cares more
than me.
05-08-2011, 03:28 AM
Allan McRae
krb5
On 08/05/11 01:14, Stéphane Gaudreault wrote:
* Replace heimdal by the MIT Kerberos implementation, krb5
* Rebuilded [core] packages :
- librpcsecgss
- libtirpc
- nfs-utils
- openssh
Please signoff both.
Thanks
openssh still works, as do other packages that I have updated for this
rebuild. I do not use any actual kerberos stuff though...
Signoff i686,
Allan
05-08-2011, 09:16 AM
Thomas Bächler
krb5
Am 07.05.2011 17:14, schrieb Stéphane Gaudreault:
> * Replace heimdal by the MIT Kerberos implementation, krb5
> * Rebuilded [core] packages :
> - librpcsecgss
> - libtirpc
> - nfs-utils
> - openssh
>
> Please signoff both.
> Thanks
>
> Stéphane
I can't use firefox. I cannot restore my old session. Creating a new
session works, but as soon as I want to open a serious website, it
segfaults. I suspect it is due to this update series which I ran last night:
gtk2 got updated, which seems the only one related to firefox.
05-08-2011, 09:43 AM
Thomas Bächler
krb5
Am 08.05.2011 11:16, schrieb Thomas Bächler:
> Am 07.05.2011 17:14, schrieb Stéphane Gaudreault:
>> * Replace heimdal by the MIT Kerberos implementation, krb5
>> * Rebuilded [core] packages :
>> - librpcsecgss
>> - libtirpc
>> - nfs-utils
>> - openssh
>>
>> Please signoff both.
>> Thanks
>>
>> Stéphane
>
> I can't use firefox. I cannot restore my old session. Creating a new
> session works, but as soon as I want to open a serious website, it
> segfaults. I suspect it is due to this update series which I ran last night:
>
> [...]
> [2011-05-08 02:13] upgraded dconf (0.7.3-2 -> 0.7.4-1)
This was actually the dconf update, which is not krb5 related.
05-08-2011, 10:07 AM
Andrea Scarpino
krb5
On Saturday 07 May 2011 11:14:27 Stéphane Gaudreault wrote:
> * Replace heimdal by the MIT Kerberos implementation, krb5
> * Rebuilded [core] packages :
> - librpcsecgss
> - libtirpc
> - nfs-utils
> - openssh
no signoff.
Le 8 mai 2011 06:11:06, Andrea Scarpino a écrit :
> On Sunday 08 May 2011 12:07:18 Andrea Scarpino wrote:
> > no signoff.
> >
> > nfs-utils is broken:
> > # /etc/rc.d/nfs-server start
> >
> > :: Mounting nfsd filesystem
> >
> > [DONE]
> >
> > :: Exporting all directories
> >
> > [DONE]
> >
> > :: Starting rpc.nfsd daemon
> >
> > [DONE]
> >
> > :: Starting rpc.mountd daemon
> >
> > [BUSY] /usr/sbin/rpc.mountd: bad version number: 1
> > Usage: /usr/sbin/rpc.mountd [-F|--foreground] [-h|--help] [-v|--version]
> > [-d kind|--debug kind]
> >
> > [-o num|--descriptors num] [-f exports-file|--exports-file=file]
> > [-p|--port port] [-V version|--nfs-version version]
> > [-N version|--no-nfs-version version] [-n|--no-tcp]
> > [-H ha-callout-prog] [-s|--state-directory-path path]
> > [-g|--manage-gids] [-t num|--num-threads=num]
> >
> > [FAIL]
>
> Changing line 21 in /etc/conf.d/nfs-server.conf with:
> MOUNTD_OPTS="--no-nfs-version 2"
> fixed it.
Fixed.
05-10-2011, 06:15 PM
Stéphane Gaudreault
krb5
Le 7 mai 2011 23:28:31, Allan McRae a écrit :
> On 08/05/11 01:14, Stéphane Gaudreault wrote:
> > * Replace heimdal by the MIT Kerberos implementation, krb5
> >
> > * Rebuilded [core] packages :
> > - librpcsecgss
> > - libtirpc
> > - nfs-utils
> > - openssh
> >
> > Please signoff both.
> > Thanks
>
> openssh still works, as do other packages that I have updated for this
> rebuild. I do not use any actual kerberos stuff though...
>
> Signoff i686,
> Allan
krb5
