On Fri, Mar 06, 2009 at 09:39:31PM +0100, Hartmut Brandt wrote:
quoted text
>=20
> Hi Tom,
>=20
> On Sat, 28 Feb 2009, Tom McLaughlin wrote:
>=20
> TM>Tom McLaughlin wrote:
> TM>> Harti Brandt wrote:
> TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote:
> TM>
> TM>> > > Both create entries in /var/log/messages like:
> TM>> > >=20
> TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error:  Miscell=
aneous
quoted text
> TM>> > > failure (see
> TM>> > > text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=
ZZZZZZZZZZZZZ
quoted text
> TM>Z
> TM>> Z
> TM>> >  ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
> TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ
> TM>> > >=20
> TM>> > > I've tried to figure out in which of the dozens of layered libra=
ries
quoted text
> TM>> > > (gss, sasl, ssl, ......) this error is generated but did not find
> TM>> > > anything.
> TM>> > >=20
> TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in sshd_c=
onfig
quoted text
> TM>> > > (as I said, this worked before).
> TM>> > So to answer my own mail: I made a link from the kerberos ticket f=
ile
quoted text
> TM>> > which contains the host ticket (and is specified in nss_ldap.conf)=
 to
quoted text
> TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, though.
> TM>>=20
> TM>> There may be an issue with the env method used in nss_ldap to change=
 the
quoted text
> TM>> credentials cache.  My mind is fuzzy but I do recall a similar issue=
 but
quoted text
> TM>> don't remember the exact cause or case.  nss_ldap has a second confi=
gurable
quoted text
> TM>> ccname method which when I submitted the original patch I intended to
> TM>> switch to once we had a newer heimdal.  Once I get nss_ldap working =
on my
quoted text
> TM>> box I intend to submit another patch.
> TM>>=20
> TM>> tom
> TM>
> TM>Hi Harti (CC maintainer),
> TM>
> TM>Can you try the attached patch for nss_ldap?  This should cause the ho=
st
quoted text
> TM>ticket to work correctly on -CURRENT.  It's "my box approved".
>=20
> Does not work. I rebuilt my system with today's sources to be sure,=20
> removed my patches to the two library makefiles and rebuilt nss_ldap with=
=20
quoted text
> your patch. I get:
>=20
> # ls -l
> dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol "GSS_C_NT_HOSTB=
ASED_SERVICE"
quoted text
> /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol "gs=
s_oid_equal"
quoted text
>=20
> Basically on everything I enter. Luckily vi still works :-)
>=20
> I saw that the configuration script claims not to find=20
> gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because the=20
> test program for -lgssapi_krb5 links only to gssapi_krb5 but not to gssap=
i=20
quoted text
> and so gets a lot of errors. I fixed this by adding gssapi, but the final=
=20
quoted text
> result was the same.

It seems that this is because libgssapi_krb5, libgssapi_spnego
and several other heimdal shared libraries are not linked against libgssapi.