search for: krb5_cc_default

...lresolv checking for library containing crypt... -lcrypt checking for krb5_init_context in -lkrb5... no checking for krb5int_getspecific in -lkrb5support... no checking for library containing pthread_setspecific... -lpthread checking for krb5int_setspecific in -lkrb5support... no checking for krb5_cc_default in -lkrb5... no configure: error: cannot find usable Kerberos v5 library [root at localhost webauth-3.5.4]# However, when I search via rpm, I see: [root at localhost webauth-3.5.4]# rpm -qa | grep -i krb krb5-libs-1.5-26 krb5-libs-1.5-29 krb5-server-1.5-29 pam_krb5-2.2.11-1 pam_krb5...

...BACKTRACE: 18 stack frames: #0 /usr/sbin/winbindd(smb_panic2+0x1ec) [0x80d2a05] #1 /usr/sbin/winbindd(smb_panic+0x25) [0x80d2813] #2 /usr/sbin/winbindd [0x80be377] #3 /usr/sbin/winbindd [0x80be3ed] #4 [0xffffe420] #5 /usr/lib/libkrb5.so.17 [0x400b3d12] #6 /usr/lib/libkrb5.so.17(krb5_cc_default+0x40) [0x400b3ed0] #7 /usr/sbin/winbindd(kerberos_kinit_password+0x85) [0x81920f0] #8 /usr/sbin/winbindd(cli_session_setup_spnego+0x355) [0x80f19ec] #9 /usr/sbin/winbindd [0x80806da] #10 /usr/sbin/winbindd(cm_fresh_connection+0x33) [0x8080f03] #11 /usr/sbin/winbindd [0x8087e05] #1...

On Thu, 2017-02-09 at 14:45 -0600, Chad William Seys wrote: > Hi Jeff, > Could you look at the following mailing list posting? > > https://lists.samba.org/archive/samba/2017-February/206468.html > > It looks like cifs.upcall has changed its behavior. As described in > that post, I can mount with root / kerberos, but then cannot access with > another user who has

...ic () #5 0x080b76ac in fault_report () #6 0x080b7721 in sig_fault () #7 <signal handler called> #8 0x2857631c in strcmp () from /lib/libc.so.5 #9 0x2833f02b in krb5_cc_register () from /usr/lib/libkrb5.so.7 #10 0x2833f138 in krb5_cc_resolve () from /usr/lib/libkrb5.so.7 #11 0x2833f360 in krb5_cc_default () from /usr/lib/libkrb5.so.7 #12 0x080eedc2 in cli_krb5_get_ticket () #13 0x080efc61 in spnego_gen_negTokenTarg () #14 0x081784fc in ads_sasl_spnego_krb5_bind () #15 0x08178866 in ads_sasl_spnego_bind () #16 0x08178f97 in ads_sasl_bind () #17 0x081722d8 in ads_connect () #18 0x08082145 in ads_cach...

...b5_ccache -get_default_cc(void) +get_existing_cc(const char *env_cachename) { krb5_error_code ret; krb5_ccache cc; + char *cachename; + + if (env_cachename) { + if (setenv(ENV_NAME, env_cachename, 1)) + syslog(LOG_DEBUG, "%s: failed to setenv %d\n", __func__, errno); + } ret = krb5_cc_default(context, &cc); if (ret) { @@ -166,6 +282,14 @@ get_default_cc(void) return NULL; } + ret = krb5_cc_get_full_name(context, cc, &cachename); + if (ret) { + syslog(LOG_DEBUG, "%s: krb5_cc_get_full_name failed: %d\n", __func__, ret); + } else { + syslog(LOG_DEBUG, "%s:...

...cifs.upcall.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/cifs.upcall.c b/cifs.upcall.c index 8f146c92b4a5..dd0843e358b1 100644 --- a/cifs.upcall.c +++ b/cifs.upcall.c @@ -159,6 +159,7 @@ get_default_cc(void) { krb5_error_code ret; krb5_ccache cc; + char *cachename; ret = krb5_cc_default(context, &cc); if (ret) { @@ -166,6 +167,14 @@ get_default_cc(void) return NULL; } + ret = krb5_cc_get_full_name(context, cc, &cachename); + if (ret) { + syslog(LOG_DEBUG, "%s: krb5_cc_get_full_name failed: %d\n", __func__, ret); + } else { + syslog(LOG_DEBUG, "%s:...

Third respin of this series. Reordered for better safety for bisecting. The environment scraping is now on by default, but can be disabled with "-E" in environments where it's not needed. Also, I've added a patch to make cifs.upcall drop capabilities before doing most of its work. This may help reduce the attack surface of the program. Jeff Layton (4): cifs.upcall: convert

...or_code ret; krb5_ccache cc; - char *cachename; + char *cachename = NULL; + + cachename = get_cachename_from_process_env(pid); + if (cachename) { + if (setenv(ENV_NAME, cachename, 1)) + syslog(LOG_DEBUG, "%s: failed to setenv %d\n", __func__, errno); + free(cachename); + } ret = krb5_cc_default(context, &cc); if (ret) { @@ -182,7 +298,6 @@ get_default_cc(void) return cc; } - static krb5_ccache init_cc_from_keytab(const char *keytab_name, const char *user) { @@ -815,7 +930,7 @@ int main(const int argc, char *const argv[]) goto out; } - ccache = get_default_cc(); + ccac...

...ault@krb5_3_MIT' /lib/libssl.so.6: undefined reference to `krb5_rc_initialize@krb5_3_MIT' /lib/libssl.so.6: undefined reference to `valid_cksumtype@k5crypto_3_MIT' /net/172.17.8.206/usr/local/avinash/p4/iControl/src/subsystems/src/thirdparty/libs/libsmbclient.so: undefined reference to `krb5_cc_default@krb5_3_MIT' /net/172.17.8.206/usr/local/avinash/p4/iControl/src/subsystems/src/thirdparty/libs/libsmbclient.so: undefined reference to `krb5_cc_default_name@krb5_3_MIT' /net/172.17.8.206/usr/local/avinash/p4/iControl/src/subsystems/src/thirdparty/libs/libsmbclient.so: undefined reference to...

Small respin of the patches that I posted a few days ago. The main difference is the reordering of the series to make it do the group and grouplist manipulation first, and then the patch that makes it grab the KRB5CCNAME from the initiating process. I think the code is sound, my main question is whether we really need the command-line switch for this. Should this just be the default mode of

Apologies for v3 series, I had some extra patches in there. This is the one that should have been sent. Relabeled as v4 for clarity. Third respin of this series. Reordered for better safety for bisecting. The environment scraping is now on by default, but can be disabled with "-E" in environments where it's not needed. Also, I've added a patch to make cifs.upcall drop

this is the proposed gssapi diff against OpenSSH-current (non-portable). note: if this goes in, the old krb5 auth (ssh.com compatible) will be removed. please comment. jakob Index: auth.h =================================================================== RCS file: /home/hack/jakob/mycvs/sshgss/auth.h,v retrieving revision 1.1.1.2 retrieving revision 1.3 diff -u -r1.1.1.2 -r1.3 --- auth.h