gss-proxy October 2020

gss-proxy@lists.fedorahosted.org

4 participants
6 discussions

GSS-Proxy Question with respect to gssproxy and mod_auth_gssapi
by Jason Keltz 12 Nov '20

12 Nov '20

Hi. I've been trying to get gssproxy working with httpd and mod_auth_gssapi on CentOS 7.8. Albeit, I'm not using the httpd from CentOS, but a later 2.4.39. I setup the httpd keytab. I setup mod_auth_gssapi and was able to access my page with Kerberos auth no problem at all. Next, I wanted to get things working with gssproxy. I created /etc/gssproxy/80-httpd.conf [service/HTTP] mechs = krb5 cred_store = keytab:/xconf/httpd/keytab/httpd-www-svc.keytab cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U euid = www My web user is "www". My keytab file is in the given location. I change permission to 600, owned by root. I added to the Service section of /etc/systemd/system/httpd.service: Environment=GSS_USE_PROXY=yes I restart httpd and gssproxy. My test protected page is under a .htaccess as follows: AuthType GSSAPI AuthName "GSSAPI Login" GssapiBasicAuth On GssapiLocalName on Require valid-user When I visit the page and I don't have a ticket, I get prompted for my username and password. Access is denied. When I visit my page Apache outputs: [Thu Oct 15 15:04:12.311614 2020] [auth_gssapi:error] [pid 28584:tid 13995355614 1824] [client 130.63.97.125:57910] GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [Unspecified GSS failure. Minor code may provide more inform ation (Keytab FILE:/etc/krb5.keytab is nonexistent or empty)] ... so I know that it's not really using gssproxy because if it was, it wouldn't be looking at /etc/krb5.keytab. I enabled debugging on gssproxy, level 3, but when I access the page, gssproxy doesn't log anything. This is printed when I start gssproxy and doesn't change: [2020/10/15 23:23:26]: Service: HTTP, Keytab: /xconf/httpd/keytab/httpd-www-svc.keytab, Enctype: 23 [2020/10/15 23:23:26]: Service: nfs-server, Keytab: /etc/krb5.keytab, Enctype: 17 [2020/10/15 23:23:26]: Service: nfs-client, Keytab: /etc/krb5.keytab, Enctype: 17 [2020/10/15 23:23:26]: Debug Enabled (level: 3) [2020/10/15 23:23:26]: Problem with kernel communication! NFS server will not work [2020/10/15 23:23:26]: Failed to get peer's SELinux context (92:Protocol not available) [2020/10/15 23:23:26]: Client connected (fd = 10)[2020/10/15 23:23:26]: (pid = 24902) (uid = 0) (gid = 0)[2 I assume the "Problem with kernel communication" error is just because there is no nfs-server running here, but the gssproxy file exists. Of course if I go back and insert into the .htaccess: GssapiCredStore keytab:/xconf/httpd/keytab/httpd-www-svc.keytab ... and I make the file readable by "www" then it works, but that, of course isn't using gssproxy either. I read a bug report on Redhat about there being an issue with using "GssapiLocalName on" so I removed that and it didn't make a difference. So what is the magic bit that I'm missing to tell httpd to actually use gssproxy? I thought the only thing was the USE_GSS_PROXY=yes Does the application itself need to be aware of gssproxy, or is that hidden from the application? I even tried adding to the httpd.service: Environment=KRB5_TRACE=/tmp/log ... hoping this would give me *something* but the file didn't even get created. Any feedback that you can provide would be helpful. Jason.

2 15

[gssapi/gssproxy] e2240d: Update EXTRA_DIST for missing test files
by Robbie Harwood 30 Oct '20

30 Oct '20

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: e2240d1b8f1d68fdfbf0881ad892d9b1956e4512 https://github.com/gssapi/gssproxy/commit/e2240d1b8f1d68fdfbf0881ad892d9b19… Author: Robbie Harwood <rharwood(a)redhat.com> Date: 2020-10-30 (Fri, 30 Oct 2020) Changed paths: M tests/Makefile.am Log Message: ----------- Update EXTRA_DIST for missing test files - t_names.py was added in 27bf21cc119005e0e6d9f1d58592408b5cd6337c - t_program.py was added in f61449b0212170d1dd619738e243e8f409ea161c - t_setcredopt.py was added in 8572a84778e1bae74fbc396d4b9922b490ee2837 Signed-off-by: Robbie Harwood <rharwood(a)redhat.com>

1 0

[gssapi/gssproxy] 803d92: Clarify mech_for_saslname implementation note
by Simo Sorce 28 Oct '20

28 Oct '20

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: 803d92a76b565a2b95469c5bb1224075a450df74 https://github.com/gssapi/gssproxy/commit/803d92a76b565a2b95469c5bb1224075a… Author: Simo Sorce <simo(a)redhat.com> Date: 2020-10-28 (Wed, 28 Oct 2020) Changed paths: M src/mechglue/gpp_indicate_mechs.c Log Message: ----------- Clarify mech_for_saslname implementation note There is nothing to actually fix in this function unless we change how interposing works. Add a note and remove the FIXME. Signed-off-by: Simo Sorce <simo(a)redhat.com>

1 0

gssproxy with ~user
by daudel＠daudel.com 26 Oct '20

26 Oct '20

Hello, I am in a student context and we use FreeIPA. The station type is fedora 31. All profiles (home directories) are stored on an NFS kerberised crypted share. Students have personnal web pages on the NFS share with ~student_name1, ~student_name2, ... The local httpd needs a TGT somwhere and i suppose, gssproxy is the good approach. I have try a lot of things with gssproxy to allow local httpd tu access the pages with no real success. Here is "the best" i had, but it's not very usable. I suppose, it existes a nicer way ? Merci beaucoup The file is for automatic deployment : gssproxy part + sudo part for students I did a setup of un ipa account apache 48/48 #!/usr/bin/bash kinit_admin(){ kinit admin <<EOF xxxxxxx EOF } apache_nfs(){ # A - gssproxy part kinit_admin rm -f /etc/gssproxy/httpd.keytab ipa-getkeytab -s $( awk '/^server/ { print $3 }' /etc/ipa/default.conf ) -k /etc/gssproxy/httpd.keytab -p apache(a)MYDOMAIN.FR kdestroy # # 80-httpd.conf # cat >/etc/gssproxy/80-httpd.conf <<ESC [service/apache] mechs = krb5 cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_48 cred_store = client_keytab:/etc/gssproxy/httpd.keytab euid = 48 ESC mkdir /etc/systemd/system/httpd.service.d cat >/etc/systemd/system/httpd.service.d/48-httpd.conf <<ESC [Service] Environment=GSS_USE_PROXY=1 ESC /usr/bin/systemctl daemon-reload /usr/bin/systemctl restart httpd # B - sudo part # # sudo script gsproxy.sh in /usr/bin # cat >/usr/bin/gsproxy.sh <<ESC /usr/bin/kinit \$(/usr/bin/logname) if [ \$? -gt 0 ] ; then /usr/bin/echo "Password error" /usr/bin/echo "Restart sudo" exit 1 fi /usr/bin/kdestroy -c /var/lib/gssproxy/clients/krb5cc_48 /usr/bin/kinit -k -t /etc/gssproxy/httpd.keytab -c /var/lib/gssproxy/clients/krb5cc_48 -p apache(a)MYDOMAIN.FR /usr/bin/kdestroy ESC # # sudo file # echo '%utilisateurs ALL = /usr/bin/gsproxy.sh' >/etc/sudoers.d/gsproxy chmod +x /usr/bin/gsproxy.sh }

2 4

[gssapi/gssproxy] 00512f: Always shortcircuit mech_invoke to the local mech
by Simo Sorce 13 Oct '20

13 Oct '20

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: 00512f48100235923c1319b588f24b73a9c5fb7a https://github.com/gssapi/gssproxy/commit/00512f48100235923c1319b588f24b73a… Author: Simo Sorce <simo(a)redhat.com> Date: 2020-10-13 (Tue, 13 Oct 2020) Changed paths: M src/mechglue/gpp_misc.c Log Message: ----------- Always shortcircuit mech_invoke to the local mech There is no point i proxying what is currently implement in the krb5 mechanism, and gssntlmssp does not use this, nor does the SPNEGO pseudo-mech. Signed-off-by: Simo Sorce <simo(a)redhat.com>

1 0

[gssapi/gssproxy] 89e9f4: Implement remoting gss_localname function.
by Simo Sorce 13 Oct '20

13 Oct '20

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: 89e9f40a8801af9373b3bc17696413af657b05f9 https://github.com/gssapi/gssproxy/commit/89e9f40a8801af9373b3bc17696413af6… Author: Simo Sorce <simo(a)redhat.com> Date: 2020-10-13 (Tue, 13 Oct 2020) Changed paths: M src/client/gpm_import_and_canon_name.c M src/client/gssapi_gpm.h M src/gp_common.h M src/gp_rpc_import_and_canon_name.c M src/mechglue/gpp_misc.c Log Message: ----------- Implement remoting gss_localname function. Uses an option on a GSSX_IMPORT_AND_CANON_NAME, to change this function behavior. Returns the value as an option as well. If the server does not understand the option it will return a normal name canonicalization and we fall back to local. Signed-off-by: Simo Sorce <simo(a)redhat.com> Commit: 27bf21cc119005e0e6d9f1d58592408b5cd6337c https://github.com/gssapi/gssproxy/commit/27bf21cc119005e0e6d9f1d58592408b5… Author: Simo Sorce <simo(a)redhat.com> Date: 2020-10-13 (Tue, 13 Oct 2020) Changed paths: M tests/Makefile.am A tests/t_names.c A tests/t_names.py M tests/testlib.py Log Message: ----------- Add new test unit for name functions Signed-off-by: Simo Sorce <simo(a)redhat.com> Commit: 19e88ab1655de6176118ad88350ba7a8f58d4208 https://github.com/gssapi/gssproxy/commit/19e88ab1655de6176118ad88350ba7a8f… Author: Simo Sorce <simo(a)redhat.com> Date: 2020-10-13 (Tue, 13 Oct 2020) Changed paths: M tests/t_multi_key.py M tests/t_setcredopt.py Log Message: ----------- Fix various test issues multi_key test was not restoring the gssproxy configuration causing failures in other tests setcredopt was not activating gss-proxy... testing nothing Signed-off-by: Simo Sorce <simo(a)redhat.com> Commit: 16b532e8a184ea4e3499213a4ea333e9eac65425 https://github.com/gssapi/gssproxy/commit/16b532e8a184ea4e3499213a4ea333e9e… Author: Simo Sorce <simo(a)redhat.com> Date: 2020-10-13 (Tue, 13 Oct 2020) Changed paths: M .gitignore Log Message: ----------- Update .gitignore file Signed-off-by: Simo Sorce <simo(a)redhat.com> Compare: https://github.com/gssapi/gssproxy/compare/64e4a99d0bfc...16b532e8a184

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

gss-proxy October 2020