gss-proxy March 2017

gss-proxy@lists.fedorahosted.org

9 participants
16 discussions

gssproxy broken on fedora
by Rob Verduijn 04 May '17

04 May '17

Hello, I've been struggling for some days on fedora25 to get gssproxy to work. After a long time I decided to try this on centos73 to see if I was doing it wrong. After a minimal install and joining it to the ipa domain the gssproxy was working flawless. After checking for the oompthied time for typos and possible kvno errors in the keytabs I can say that the configuration that works flawlessly on centos73 does not work on fedora25. I first wondered if autofs and gssproxy wouldn't play nice together, but it seems I have been fighting this bug on centos73 and fedora24/25: https://fedorahosted.org/sssd/ticket/3080 Any idea when the fix will be released ? So after disabling autofs on centos and adding the mount to /etc/fstab the gssproxy started to work flawlessly. Also on a side note for nfs-idmapd : Method = sss seems to work a lot better for me than Method = nsswitch Any idea how to start to determine why gssproxy is broken on fedora 25 ? Rob Verduijn

7 43

fedorahosted stopped, will there be a new gssproxy website ?
by Rob Verduijn 30 Mar '17

30 Mar '17

Hello, I noticed that the gssproxy website at fedorahosted is no longer available. Obviously because fedorahosted got canceled. https://fedoraproject.org/wiki/Infrastructure/Fedorahosted-retirement I see pagure is now the place to look for git and tracking stuff. https://pagure.io/fork/simo/gssproxy But there was some valuable documentation on the original site, will that be reinstated somewhere ? Cheers Rob Verduijn

3 2

branch sadness deleted (was 7f08cf3)
by git repository hosting 30 Mar '17

30 Mar '17

This is an automated email from the git hooks/post-receive script. rharwood pushed a change to branch sadness in repository gssproxy. was 7f08cf3 Use insecure getenv(3) for GSS_USE_PROXY and GSSPROXY_BEHAVIOR This change permanently discards the following revisions: discards 7f08cf3 Use insecure getenv(3) for GSS_USE_PROXY and GSSPROXY_BEHAVIOR -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

branch sadness created (now 7f08cf3)
by git repository hosting 30 Mar '17

30 Mar '17

This is an automated email from the git hooks/post-receive script. rharwood pushed a change to branch sadness in repository gssproxy. at 7f08cf3 Use insecure getenv(3) for GSS_USE_PROXY and GSSPROXY_BEHAVIOR This branch includes the following new commits: new 7f08cf3 Use insecure getenv(3) for GSS_USE_PROXY and GSSPROXY_BEHAVIOR The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 1

branch master updated (eada55e -> b50a863)
by git repository hosting 27 Mar '17

27 Mar '17

This is an automated email from the git hooks/post-receive script. rharwood pushed a change to branch master in repository gssproxy. from eada55e Allow connection to self when impersonator set new 9bdb462 Turn on -Wextra new e72d1fa Fix unused variables new eb39b7c Fix mismatched sign comparisons new 10e0a86 Fix error checking on get_impersonator_fallback() new b50a863 Remove gpm_release_ctx() to fix double unlock The 5 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. Summary of changes: proxy/Makefile.am | 2 +- proxy/src/client/gpm_acquire_cred.c | 11 +++------- proxy/src/client/gpm_common.c | 11 +++------- proxy/src/client/gpm_display_status.c | 2 +- proxy/src/client/gpm_import_and_canon_name.c | 7 +++--- proxy/src/client/gpm_indicate_mechs.c | 33 ++++++++++++---------------- proxy/src/client/gpm_release_handle.c | 2 +- proxy/src/gp_common.h | 4 ++-- proxy/src/gp_config.c | 17 +++++--------- proxy/src/gp_conv.c | 10 ++++----- proxy/src/gp_conv.h | 3 +-- proxy/src/gp_creds.c | 12 +++++----- proxy/src/gp_export.c | 9 +++----- proxy/src/gp_init.c | 2 +- proxy/src/gp_rpc_accept_sec_context.c | 3 +-- proxy/src/gp_rpc_acquire_cred.c | 8 +++---- proxy/src/gp_rpc_debug.c | 26 +++++++++++----------- proxy/src/gp_rpc_get_mic.c | 4 ++-- proxy/src/gp_rpc_import_and_canon_name.c | 5 ++--- proxy/src/gp_rpc_indicate_mechs.c | 20 ++++++----------- proxy/src/gp_rpc_init_sec_context.c | 3 +-- proxy/src/gp_rpc_process.c | 21 ++++-------------- proxy/src/gp_rpc_process.h | 6 +++++ proxy/src/gp_rpc_release_handle.c | 5 ++--- proxy/src/gp_rpc_unwrap.c | 5 ++--- proxy/src/gp_rpc_verify_mic.c | 5 ++--- proxy/src/gp_rpc_wrap.c | 4 ++-- proxy/src/gp_rpc_wrap_size_limit.c | 5 ++--- proxy/src/gp_socket.c | 6 ++--- proxy/src/gp_util.c | 4 ++-- proxy/src/gssproxy.c | 2 +- proxy/tests/t_utils.c | 4 ++-- 32 files changed, 104 insertions(+), 157 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 5

branch master updated (dc46232 -> eada55e)
by git repository hosting 14 Mar '17

14 Mar '17

This is an automated email from the git hooks/post-receive script. rharwood pushed a change to branch master in repository gssproxy. from dc46232 Properly renew expired credentials new 73b50c0 Change impersonator check code new eada55e Allow connection to self when impersonator set The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. Summary of changes: proxy/configure.ac | 3 + proxy/src/gp_creds.c | 190 ++++++++++++++++++++++++++++-------- proxy/src/gp_rpc_creds.h | 3 +- proxy/src/gp_rpc_init_sec_context.c | 2 +- proxy/tests/t_impersonate.py | 35 +++++-- 5 files changed, 183 insertions(+), 50 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 2

branch master updated (6a6951d -> dc46232)
by git repository hosting 14 Mar '17

14 Mar '17

This is an automated email from the git hooks/post-receive script. rharwood pushed a change to branch master in repository gssproxy. from 6a6951d Add mailing list and IRC links to README new dc46232 Properly renew expired credentials The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. Summary of changes: proxy/src/gp_creds.c | 14 +++++++++----- proxy/src/mechglue/gpp_acquire_cred.c | 5 +++++ 2 files changed, 14 insertions(+), 5 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 1

Released v0.7.0
by Robbie Harwood 10 Mar '17

10 Mar '17

Highlights: - RHEL-7 support - Migration to Pagure completed - Support syncing changed credentials Robbie Harwood (13): - Clean up build flags - Detect kerberos.schema on RHEL - Fix behavior when not passed config\_dir on the command line - Document debug\_level option in gssproxy.conf(5) - Fix asprintf(3) call in ensure\_segregated\_ccache() - Appease Coverity - Remove unused variables in t\_acquire.c - Markdown conversion of docs from Trac - Pagure-ify release process - Remove outdated selinux issue from Apache docs - Update Apache docs to match latest releases - Fix broken link in protocol docs - Release version 0.7.0 Simo Sorce (16): - Fix incorrect use of non-null terminated string - Fix another incorrect use of non-null term. string - Always check if we have a remote credential - Fix potential memleak from gpm\_release\_cred - Local vs Remote cred check fixes - Add a helper function to pack options - Add ability to sync creds back on modification - Do not re-export unchanged creds - Rework gpp\_cred\_handle management - Add utility function to compare gssx\_creds - Always request cred sync on init\_sec\_context - If credentials changed try to store them - Change tests to always exercise ccache sycns - Add support for the NO\_CI\_FLAG credentials option - Add test to check setting cred options - Ensure test suite reports failure on traceback Source: https://releases.pagure.org/gssproxy/gssproxy-0.7.0.tar.gz sha512sum: https://releases.pagure.org/gssproxy/gssproxy-0.7.0.tar.gz.sha512sum.txt

5 10

branch master updated (ff5f684 -> 6a6951d)
by git repository hosting 08 Mar '17

08 Mar '17

This is an automated email from the git hooks/post-receive script. rharwood pushed a change to branch master in repository gssproxy. from ff5f684 Create release page for v0.7.0 new 6a6951d Add mailing list and IRC links to README The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. Summary of changes: README => README.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) rename README => README.md (69%) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 1

migration from svcgssd to gssproxy results in regression.
by NeilBrown 08 Mar '17

08 Mar '17

Hi, I recently tried using gssproxy for krb5 authentication with nfsd. This was because customer is using an AD kerberos master which uses certificates which are too big for svcgssd to work with (i.e. larger than one page). Unfortunately it doesn't work. The svcgssd code in nfs-utils calls gss_display_name() to get the name of the principal. This returns something like "user@domain". getpwnam() works perfectly on this (when nsswitch is set to use "winbind") but svcgssd goes further and uses nfs4_gss_princ_to_ids() to perform the lookup. Presumably this is more general? gssproxy does neither of these. It uses gss_localname() to get the user name, which returns something like "user". It then calls getpwnam() on that, which fails ("user@domain" or "domain\user" both succeed). I have modified my copy to use gss_display_name() instead of gss_localname() and it now appears to work perfectly ... for this use-case at least. What is the right way forward here? Is nfs4_gss_princ_to_ids() really necessary? Should gssproxy use it, at least for requests from the NFS server? Is there are good reason not to use gss_display_name() uniformly? Maybe use gss_local_name(), and it that fails, or getpwnam fails, use gss_display_name()?? Thanks, NeilBrown

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

gss-proxy March 2017