pam_krb5, NFSv4, AutoFS mounted home dirs
by Dax Kelson
I have three testing FC2 boxes in a Kerb5 realm, with the following
updates:
kernel-smp-2.6.9-1.6_FC2
pam_krb5-2.1.2-1
nfs-utils-1.0.6-44 (note that the FC3 SRPM will only compile with gcc
3.4)
I'm trying to setup centralized home directories securely shared with
strong user authentication with integrity checking (aka krb5i) and
moving adding encrypted NFS (aka krb5p) when supported. Something I've
been wanting to do for years.
I've run into a minor issue, and a show stopper.
Minor issue:
I had to insert a "modprobe rpcsec_gss_krb5" into /etc/init.d/rpcgssd on
the client(s) and into /etc/init.d/rpcsvcgssd on the server.
Show stopper:
pam_krb5 creates per session ticket cache files
as /tmp/krb5cc_p<digits>, while the NFS client's rpcsec_gss daemon
expects the ticket cache file to be /tmp/krb5cc_$UID.
This issue is mentioned briefly on:
http://www.citi.umich.edu/projects/nfsv4/2.4-nfsv4/release1/install.html
The solution on the page doesn't work (catch-22) in a krb5-secured-
automounted-homedir scenario as, it says to add the following to your
login script:
# move kerberos cred file to a place where gssd can find it
TMPNAME=`/bin/basename ${KRB5CCNAME:-unset}`
if [ -f /tmp/${TMPNAME} ]; then
mv /tmp/${TMPNAME} /tmp/krb5cc_${UID}
KRB5CCNAME="FILE:/tmp/krb5cc_${UID}"
fi
The page also says:
"The Kerberos PAM library creates a per-session ticket file in /tmp.
This file must be moved to a per-UID location so that gssd can find it
(this will be fixed in a future release)."
What the current status?
What's the solution?
Has anyone approached Nalin about modifying pam_krb5?
What's the impact of ditching per session ticket cache and going to per
UID?
Thanks,
Dax Kelson
Guru Labs
19 years, 4 months
rawhide report: 20041207 changes
by Build System
Updated Packages:
abiword-1:2.2.1-1
-----------------
* Mon Dec 06 2004 Caolan McNamara <caolanm(a)redhat.com> - 1:2.2.1-1
- bump to new version
- geometry patch upstreamed
- security patch upstreamed
- removeoledecod patch upstreamed
- regenerate desktop patch
authconfig-4.6.7-1
------------------
* Mon Dec 06 2004 Tomas Mraz <tmraz(a)redhat.com> - 4.6.7-1
- updated translations
- winbind in authconfig-gtk.py was setting the nsswitch.conf on the auth tab
- use GtkComboBox instead of deprecated GtkOptionMenu
- disable options with not installed binaries, remove unnecessary deps of
authconfig-gtk
bluez-utils-2.10-4
------------------
* Tue Dec 07 2004 Florian La Roche <laroche(a)redhat.com>
- add prereq for service/chkconfig
coreutils-5.2.1-34
------------------
* Mon Dec 06 2004 Tim Waugh <twaugh(a)redhat.com> 5.2.1-34
- Don't set fs uid until after pam_open_session (bug #77791)..
exim-4.43-2
-----------
* Mon Dec 06 2004 Thomas Woerner <twoerner(a)redhat.com> 4.43-2
- rebuild
foomatic-3.0.2-11
-----------------
* Mon Dec 06 2004 Tim Waugh <twaugh(a)redhat.com> 3.0.2-11
- Updated db to 20041206.
gamin-0.0.19-1
--------------
* Fri Dec 03 2004 Daniel Veillard <veillard(a)redhat.com> 0.0.19-1
- still chasing the loop bug, made another pass at checking GList,
added own copy with memory poisonning of GList implementation.
- fixed a compile issue when compiling without debug
glib2-2.4.8-1
-------------
* Mon Dec 06 2004 Matthias Clasen <mclasen(a)redhat.com> - 2.4.8-1
- Upgrade to 2.4.8
gtk2-2.4.14-1
-------------
* Mon Dec 06 2004 Matthias Clasen <mclasen(a)redhat.com> - 2.4.14-1
- Upgrade to 2.4.14
- Remove the no longer needed pa.po patch
- Adjust gtk+-2.4.7-update-counter.patch
* Wed Dec 01 2004 Matthias Clasen <mclasen(a)redhat.com> - 2.4.13-13
- Revert an accidental ABI change. (#151450)
initscripts-8.01-1
------------------
* Mon Dec 06 2004 Bill Nottingham <notting(a)redhat.com> 8.01-1
- further bootup noise reductions
- rc.d/rc.sysinit: do implicit unicode conversion on keymap
java-1.4.2-gcj-compat-0:1.4.2.0-21jpp
-------------------------------------
* Mon Dec 06 2004 Gary Benson <gbenson(a)redhat.com> 0:1.4.2.0-21jpp
- Add tools.jar to CLASSPATH.
- Remove ecj.jar from CLASSPATH.
* Fri Dec 03 2004 Thomas Fitzsimmons <fitzsim(a)redhat.com> - 0:1.4.2.0-16jpp
- Add license to java files.
* Fri Dec 03 2004 Thomas Fitzsimmons <fitzsim(a)redhat.com> - 0:1.4.2.0-15jpp
- Require gcc-java.
- Add -fullversion.
libpng-2:1.2.8-1
----------------
* Mon Dec 06 2004 Matthias Clasen <mclasen(a)redhat.com> - 2:1.2.8-1
- Update to 1.2.8
* Wed Sep 15 2004 Matthias Clasen <mclasen(a)redhat.com> - 2:1.2.7-1
- Update to 1.2.7
* Tue Aug 17 2004 Matthias Clasen <mclasen(a)redhat.com> - 2:1.2.6-1
- Update to 1.2.6
- Combine patches
libpng10-1.0.18-1
-----------------
* Mon Dec 06 2004 Matthias Clasen <mclasen(a)redhat.com> - 1.0.18-1
- Update to 1.0.18
rpmdb-fedora-1:4-0.20041207
---------------------------
rsh-0.17-27
-----------
* Mon Dec 06 2004 Karel Zak <kzak(a)redhat.com> 0.17-27
- remove BSD stuff "signal(SIGCHLD, SIG_IGN)". It's unsupported by POSIX/linux. (#122315)
thunderbird-0:1.0-0.rc1.1
-------------------------
* Mon Dec 06 2004 Christopher Aillon <caillon(a)redhat.com> 1.0-0.rc1.1
- Fix advanced prefs
valgrind-1:2.2.0-7
------------------
* Mon Dec 06 2004 Jakub Jelinek <jakub(a)redhat.com> 2.2.0-7
- update URL (#141873)
vim-1:6.3.042-1
---------------
* Mon Dec 06 2004 Karsten Hopp <karsten(a)redhat.de> 6.3.042-1
- patchlevel 42
19 years, 4 months
Re: Kudzu and automatic detection
by Ron Yorston
"John (J5) Palmieri" <johnp(a)redhat.com> wrote:
>On Mon, 2004-12-06 at 13:30, Nicolas Mailhot wrote:
>> Le lundi 06 décembre 2004 à 12:38 -0500, John (J5) Palmieri a écrit :
>>
>> > I don't see a bug on this in bugzilla. Rule of thumb is if it is not
>> > filed in bugzilla it is not going to get fixed. This is why we have the
>> > test releases and rawhide. Please file a bug on hal-cups-utils.
>>
>> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=119970
>>
>> And yes the problem evolved somewhat since the bug was filled. The
>> number of steps to perform to get the printer operational after power-up
>> has shrunk a bit. But the autodetected hal printer is still pretty
>> useless - if I hadn't created my own printer setup (with a different
>> name than the HAL one else HAL would just nuke it) I couldn't print
>> without going into system-config-printer every single time the printer
>> is powered up.
>
>That bug is before my time.
Then this one will be even more before your time:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=58901
Things do seem to have got better since then, but it's clearly still an
issue in some cases. My solution to 58901 was a patch to kudzu which
allowed the user to specify that a device was expected to be connected
intermittently. In that case kudzu would retain the configuration and
not pester the user about it as the device came and went.
Ron
19 years, 4 months
Thunderbird 1.0rc: XML Parsing error
by Jos Vos
Hi,
When I select Preferences -> Advanced in Thunderbird 1.0rc I see a
XML Parsing Error: not well-formed
Location: chrome://messenger/content/pref-advanced.xul
Line number 208, Column 5:
This is after rebuilding the src.rpm on RHEL3 (with a few tweaks),
so I'm now wondering if this also happens on FC3. Anyone?
Thanks,
--
-- Jos Vos <jos(a)xos.nl>
-- X/OS Experts in Open Systems BV | Phone: +31 20 6938364
-- Amsterdam, The Netherlands | Fax: +31 20 6948204
19 years, 4 months
JFS Filesystems?
by Nick Bargnesi
Hey guys,
I've got some high-end Athlon 64 workstations that I'd like to
use JFS exclusively on. These machines have 8 hard drives in them six
of which are on SATA channels. Attempting to install FC3 by booting
with "linux jfs" results in my being able to format drives using JFS.
However, after the package selection when it goes to install chkconfig
(second rpm I believe?), it fails with a complaint about installing
chkconfig due to a disc or hard drive error, or bad media, etc. I get
the sense this is directly related to the JFS configuration though, if
I attempt to do the identical setup on ext3 partitions, everything
works flawlessly.
I was however able to install FC3 on these machines using a root
partition of ext3 and jfs partitions not directly related to the FC3
directory structure, i.e., /opt, and some backup mount points. I've
read about trying "linux jfs selinux=0" as jfs won't mingle with
selinux, which I haven't done yet. Curious to see if anyone else is
using non-ext filesystems and experienced/gotten past this. Or to
smack me upside the head and say selinux=0 should do it...
Regards,
Nick Bargnesi
--
Nick Bargnesi
http://www.den-4.com
Den 4 Software
pub 1024D/E8BD2FD0 2004-12-02 Nick Bargnesi <nbargnesi(a)gmail.com>
Key fingerprint = 6F9D 9404 63CD 2B04 DE7A 0F9D A1ED C1B0 E8BD 2FD0
sub 2048g/56C5D45B 2004-12-02
19 years, 4 months
Thunderbird 1.0 and Enigmail
by Jos Vos
Hi,
Any chance to get Enigmail back, either in the Thunderbird 1.0 rpm
or as an additional Fedora (non-extras) package?
Enigmail is said to have a version for Thunderbird 1.0 now. IIRC
it was once removed because of a maintenance nightmare, maybe this
problem disappears after the official release of Thunderbird?
Thanks,
--
-- Jos Vos <jos(a)xos.nl>
-- X/OS Experts in Open Systems BV | Phone: +31 20 6938364
-- Amsterdam, The Netherlands | Fax: +31 20 6948204
19 years, 4 months
JPackage 1.6
by Nicolas Mailhot
[This is a repost of the 19 november announce on JPackage lists. Since
JPackage serves is the upstream of numerous of FC Java packages I was
asked to echo it on FC-related rpm lists. Many thanks to Paul Nasrat for
the original announcement]
The JPackage Project http://www.jpackage.org/ is pleased to announce a
new release. Upgrading should be a simple matter of pointing your
preferred depsolver at a mirror documented at
http://www.jpackage.org/repos.php
Since JPackage 1.5, the team has grown thanks to vendor interest and we
will continue providing packaging java packages, and we hope to have
some more exciting news soon.
JPackage will continue to host a devel repository for future large
changes. Please update your preferred depsolver to point to the 1.6
repositories as documented:
http://www.jpackage.org/repos.php
[ You will usually need the generic & distro-specific repository. Devel
is for testers ]
Thanks once more to all the contributors and users
Highlights
==========
Ant 1.6.2 is one of the biggest highlights, along with having maven and
lots of updated packages.
Contribuors
===========
In no particular order JPackage is:
* Ralph Apel
* Gary Benson
* Pete Chown
* Leonid Dubinsky
* Thomas Fitzsimmons
* Henri Gomez
* Sonja Krause-Harder
* Goulven Le Jeune
* Nicolas Mailhot
* Paul Nasrat
* Fernando Nasser
* Kaj J. Niemi
* Robert Ottenhag
* Jens Skripczynski
* Ville Skyttä
* Sebastiano Vigna
* David Walluck
* Christian Zoffoli
Thanks
======
In addition thanks to Randy Walter for Ant 1.6.X work and Carwyn Edwards
for work on the 1.5 JDK.
As always we wish to thank the community for all their contributions and
work.
Notes
=====
JPackage no longer supports or distributes Java SDK version 1.3. The
version of the Java SDK supported in this release is 1.4. Java SDK
1.5 from Sun is also provided in the non-free section.
Removed from free (5 packages: 2 removed + 3 obsolete)
======================================================
keytoolgui (replaced by portecle)
plexus-container
saxpath (merged into jaxen)
stylebook
toolbutton (merged into toolbar)
Removed from non-free (4 packages)
==================================
java-1.3.1-bea
java-1.3.1-blackdown
java-1.3.1-ibm
java-1.3.1-sun
New in free (59 packages)
=========================
aopalliance
axion
blowfish-j
burlap
carol
classpathx-jaf
classpathx-mail
clover
easymock
easymockclassextension
eclipse-gef
ehcache
ehcache-bootstrap
freemarker
geronimo-modules
geronimo-specs
gnu-crypto
gvf
hessian
hibernate
howl-logger
ibatis
ibatis1
idb
jacorb
jakarta-commons-attributes
jakarta-commons-jexl
jakarta-commons-latka
jakarta-slide-server
jboss4-aop
jboss4-buildmagic-tasks
jboss4-cache
jboss4-common
jboss4-jmx
jboss4-system
jetty5
joesnmp
howl-logger
ibatis
ibatis1
idb
jacorb
jakarta-commons-attributes
jakarta-commons-jexl
jakarta-commons-latka
jakarta-slide-server
jboss4-aop
jboss4-buildmagic-tasks
jboss4-cache
jboss4-common
jboss4-jmx
jboss4-system
jetty5
joesnmp
jonas
jonathan-core
jonathan-jeremie
joram
jotm
junitejb
maven
netbeans
odmg
openejb
owanttask
owdeploysched
pdfbox
portecle
radeox
spring
swingwt
tranql
xapool
xml-commons-resolver-nb
xmlbeans
Thanks once more
The JPackage Team
--
Nicolas Mailhot
19 years, 4 months
xorg-x11-deprecated-libs yum problem
by Neal Becker
This is on FC3 x86_64.
>yum update
Error: Missing Dependency: xorg-x11-deprecated-libs is needed by package
xorg-x11-deprecated-libs-devel
Error: Missing Dependency: xorg-x11-devel is needed by package
xorg-x11-deprecated-libs-devel
19 years, 4 months