Ack, thanks Adam :)
On 16/09/11 15:30, Adam Stokes wrote:
- Verify k5start exists
- Run k5start and check the top most principal (without
this we would need to probably do some regexing through the
klist to attempt to find which principal we want)
- This will re-initialization *existing* kerberos tickets without
need for password.
- Actually show none connection options as a result of more kerberos
work
- Uses environment variables and has general defaults as a fallback
Signed-off-by: Adam Stokes<astokes(a)fedoraproject.org>
---
matahari.init.in | 4 ---
matahari.sysconf.in | 12 ----------
src/lib/mh_agent.cpp | 60 ++++++++++++++++++++++++++++++++++++++++++++++++-
3 files changed, 58 insertions(+), 18 deletions(-)
diff --git a/matahari.init.in b/matahari.init.in
index e9588f9..323ad89 100644
--- a/matahari.init.in
+++ b/matahari.init.in
@@ -46,10 +46,6 @@ start() {
MATAHARI_ARGS="--broker $MATAHARI_BROKER $MATAHARI_ARGS"
fi
- # Setup kerberos ticket renewal
- if [ -n "$KRB_RENEW" ]; then
- k5start $KRB_RENEW_ARGS $KRB_REALM
- fi
daemon $PROCESS $MATAHARI_ARGS --daemon
RETVAL=$?
diff --git a/matahari.sysconf.in b/matahari.sysconf.in
index bc25e73..edd0065 100644
--- a/matahari.sysconf.in
+++ b/matahari.sysconf.in
@@ -18,15 +18,3 @@ MATAHARI_AGENT_ARGS="--reconnect=yes"
# Per console options
# sysconfig_CONSOLE_ARGS=...
-
-# Security
-# Kerberos
-
-# Uncomment to enable auto-renew credentials
-# KRB_RENEW=yes
-
-# Set custom application and arguments for renew process
-# KRB_RENEW_ARGS="-f /etc/krb5.keytab -K 10 -l 10h"
-
-# Kerberos REALM
-# KRB_REALM="qpidd/EXAMPLE.COM"
diff --git a/src/lib/mh_agent.cpp b/src/lib/mh_agent.cpp
index 61f32bf..4a7cbf1 100644
--- a/src/lib/mh_agent.cpp
+++ b/src/lib/mh_agent.cpp
@@ -234,8 +234,7 @@ int print_help(int code, const char *name, const char *arg, void
*userdata)
printf("\nOptions:\n");
printf("\t-h | --help print this help message.\n");
for (lpc = 0; lpc< DIMOF(matahari_options); lpc++) {
- if (matahari_options[lpc].callback
-&& matahari_options[lpc].callback != connection_option) {
+ if (matahari_options[lpc].callback) {
printf("\t-%c | --%-10s\t%s\n", matahari_options[lpc].code,
matahari_options[lpc].long_name,
matahari_options[lpc].description);
}
@@ -251,6 +250,50 @@ mh_connect(OptionsMap mh_options, OptionsMap amqp_options, int
retry)
int backoff = 0;
GList *srv_records = NULL, *cur_srv_record = NULL;
struct mh_dnssrv_record *record;
+ GError *error = NULL;
+ int status;
+ std::string krb5_keytab(mh_options["krb5_keytab"].asString());
+ std::string krb5_interval(mh_options["krb5_interval"].asString());
+ const gchar *k5start_bin[] = {
+ "/usr/bin/k5start",
+ "-U",
+ "-f",
+ krb5_keytab.c_str(),
+ "-K",
+ krb5_interval.c_str(),
+ NULL,
+ };
+
+ mh_trace("kerberos: %s %s %s %s %s %s",
+ k5start_bin[0],
+ k5start_bin[1],
+ k5start_bin[2],
+ k5start_bin[3],
+ k5start_bin[4],
+ k5start_bin[5]);
+
+ /* Attempt to initiate k5start for credential renewal's without
+ * prompting for a password each time an agent is run
+ */
+ if
(strcmp(amqp_options["sasl-mechanism"].asString().c_str(),"GSSAPI") ==
0) {
+ if (g_file_test(k5start_bin[0], G_FILE_TEST_IS_EXECUTABLE)) {
+ mh_trace("Running k5start");
+ if (!g_spawn_sync(
+ NULL,
+ (gchar **) k5start_bin,
+ NULL,
+ G_SPAWN_SEARCH_PATH,
+ NULL,
+ NULL,
+ NULL,
+ NULL,
+&status,
+&error)) {
+ mh_warn("k5start failure: %s", error->message);
+ g_error_free(error);
+ }
+ }
+ }
if (!mh_options.count("servername") ||
mh_options.count("dns-srv")) {
/*
@@ -342,6 +385,19 @@ read_environment(OptionsMap& options)
if (data&& strlen(data)) {
options["serverport"] = data;
}
+ data = getenv("KRB5_KEYTAB");
+ if (data&& strlen(data)) {
+ options["krb5_keytab"] = data;
+ } else {
+ options["krb5_keytab"] = "/etc/krb5.keytab";
+ }
+
+ data = getenv("KRB5_INTERVAL");
+ if (data&& strlen(data)) {
+ options["krb5_interval"] = data;
+ } else {
+ options["krb5_interval"] = "10";
+ }
}
static void