On Mon, 2016-09-12 at 14:06 +0200, Lukas Slebodnik wrote:
>
> On (12/09/16 11:37), Joakim Tjernlund wrote:
> >
> >
> > On Mon, 2016-09-12 at 11:30 +0200, Sumit Bose wrote:
> > >
> > >
> > > On Mon, Sep 12, 2016 at 09:01:23AM +0000, Joakim Tjernlund wrote:
> > > >
> > > >
> > > >
> > > > On Mon, 2016-09-12 at 10:27 +0200, Lukas Slebodnik wrote:
> > > > >
> > > > >
> > > > >
> > > > > On (12/09/16 08:08), Joakim Tjernlund wrote:
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > On Mon, 2016-09-12 at 09:41 +0200, Sumit Bose wrote:
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > On Fri, Sep 09, 2016 at 07:07:58PM +0000, Joakim
Tjernlund wrote:
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > On Fri, 2016-09-09 at 20:53 +0200, Lukas
Slebodnik wrote:
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > On (09/09/16 18:35), Joakim Tjernlund
wrote:
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > On Fri, 2016-09-09 at 19:40 +0200,
Lukas Slebodnik wrote:
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > On (09/09/16 16:25), Sumit Bose
wrote:
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > >
> > > > > > > > > > > > On Fri, Sep 09, 2016 at
02:00:53PM +0000, Joakim Tjernlund wrote:
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > >
> > > > > > > > > > > > > On Fri, 2016-09-09 at
14:48 +0200, Sumit Bose wrote:
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > On Fri, Sep 09,
2016 at 11:46:27AM +0000, Joakim Tjernlund wrote:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > Trying to
bring up samba with sssd-13.4 and for some reason samba fails
> > > > > > > > > > > > > > > to lookup
users: From smb.log I have:
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > >
> > > > > > > > > > > > > > > On older
systems I have samba 3.6.25 and sssd 1.12.5 and there samba works
> > > > > > > > > > > > > > > fine.
> > > > > > > > > > > > > > > Is there som
change I have missed when upgrading to newer samba sssd?
> > > > > > > > > > > > > >
> > > > > > > > > > > > > > Are you using
SSSD's version of libwbclient to help samba to map SID to
> > > > > > > > > > > > >
> > > > > > > > > > > > > hmm, I got both
(/usr/lib64/libwbclient.so.0 and
> > > > > > > > > > > > >
/usr/lib64/sssd/modules/libwbclient.so)
> > > > > > > > > > > > > and wbinfo -n
'TRAN_01\jocke' reports:
> > > > > > > > > > > > > wbinfo -n
'TRAN_01\jocke'
> > > > > > > > > > > > > could not obtain winbind
interface details: WBC_ERR_WINBIND_NOT_AVAILABLE
> > > > > > > > > > > > > could not obtain winbind
separator!
> > > > > > > > > > > > > failed to call
wbcLookupName: WBC_ERR_WINBIND_NOT_AVAILABLE
> > > > > > > > > > > > > Could not lookup name
TRAN_01\jocke
> > > > > > > > > > > > >
> > > > > > > > > > > > > I guess the problem is
that samba uses its own libwbclient.so and winbind
> > > > > > > > > > > > > is not configured?
> > > > > > > > > > > >
> > > > > > > > > > > > iirc you are using gentoo. In
Fedora/RHEL is is possible to switch
> > > > > > > > > > > > those two libraries with the
alternatives command.
> > > > > > > > > > > >
> > > > > > > > > > > > To make at least wbinfo try
to use SSSD's version you can try calling it
> > > > > > > > > > > > as:
> > > > > > > > > > > >
> > > > > > > > > > > >
LD_LIBRARY_PATH=/usr/lib64/sssd/modules wbinfo -n 'TRAN_01\jocke'
> > > > > > > > > > > >
> > > > > > > > > > > > as long as wbinfo is not
complied with rpath or similar it should pick
> > > > > > > > > > > >
/usr/lib64/sssd/modules/libwbclient.so.0 instead of
> > > > > > > > > > > > /usr/lib64/libwbclient.so.0.
If there is no
> > > > > > > > > > > >
/usr/lib64/sssd/modules/libwbclient.so.0 you should add it as a softlink
> > > > > > > > > > > > to
/usr/lib64/sssd/modules/libwbclient.so. I would also expect that
> > > > > > > > > > > > there are link with ends with
a version number like 11 or 12.
> > > > > > > > > > > >
> > > > > > > > > > > and samba 4.5 has
libwbclient.so.0.13
> > > > > > > > > > >
> > > > > > > > > > > [root@host ~]# rpm -qf
/usr/lib64/samba/wbclient/libwbclient.so.0.13
> > > > > > > > > > >
libwbclient-4.5.0-0.0.rc1.fc26.x86_64
> > > > > > > > > > and lives in its own package. Is this
new from samba >= 4.5 ?
> > > > > > > > > >
> > > > > > > > > Yes,
> > > > > > > > > I cannot see it in official announcement (2
days old :-)
> > > > > > > > >
https://lists.samba.org/archive/samba-technical/2016-September/116033.html
> > > > > > > > > but samba 4.4.5 has just a
libwbclient.so.0.12
> > > > > > > > >
> > > > > > > > > But if you asked about packaging then
> > > > > > > > > the libwbclient (from samba) and
sssd-libwbclient are separate packages
> > > > > > > > > on fedora since I remember :-)
> > > > > > > > >
> > > > > > > >
> > > > > > > > I see, now the 1000 $ question, is sssd able to
use libwbclient from samba too?
> > > > > > >
> > > > > > > It does not have to. libwbclient is an interface for
Samba components to
> > > > > > > get data from winbind. The SSSD version of libwbclient
implements some
> > > > > > > parts to the interface to allow the Samba components
to get SID, name,
> > > > > > > POSIX ID mapping data from SSSD instead of winbind. So
SSSD provides the
> > > > > > > interface but does not use it.
> > > > > > >
> > > > > >
> > > > > > I guess that would be somewhat unusual case and not really
needed.
> > > > > > To summarize, in Fedora, the libwbclient libs from samba
resp. sssd are installed
> > > > > > under non standard search paths, are separate pkgs and
there is a "script"(alternatives)
> > > > > > that selects between the two by creating a symlink in
/usr/lib{,64,32} to either
> > > > > > samba's libwbclient or sssd's libwbclient. Is that
correct?
> > > > > >
> > > > > > Have you considered a more direct way? That is, if
sssd's libwbclient is built/installed
> > > > > > it always takes over(eliminaiting the need for an
alternatives script? Or just require
> > > > > > that only one of libwbclient pkgs can be installed at the
same time?
> > > > > >
> > > > > sssd-libwbclient does not implement all functions. That's
reason why it is not
> > > > > a default; and just an alternative.
> > > >
> > > > hmm, then I wonder why my samba stopped working just from moving from
samba 3.6.25 to 4.2.11/14
> > > > Maybe some bug in samba/my smb.conf ?
> > >
> > > The newer versions of Samba removed some fallback code e.g. to fix the
> > > Badlock (
http://badlock.org/) issue. The means newer versions of Samba
> > > require that winbind is running in more and more use cases. In some
> > > cases SSSD's version of libwbclient might be sufficient in some cases
> > > (see below) it is not.
> > >
> > > >
> > > >
> > > >
> > > >
> > > > Not impl. all functions makes it hard to know when to use sssd's
libwbclient,
> > > > how to figure out when sssd's libwbclient is good enough?
> > >
> > > Yes and to make is worse as mentioned above there are more and more use
> > > cases where Samba requires that winbind is running. If you have to run
> > > winbind, e.g. if you needed to proxy NTLM authentication to a AD DC, you
> > > of course have to use Samba's version of libwbclient. To make sure
the
> > > SID to POSIX ID mapping is consistent on the system SSSD 1.14 also
> > > provides an idmapping plugin for winbind (see man idmap_sss for
> > > details). With this plugin winbind will ask SSSD to do the mapping.
> > >
> >
> > I see, thanks for this info. it might not be worth to add sssd libwbclient
support to Gentoo just yet.
> > I will see if I can get samba running with native libwbclient first.
> >
> BTW SSSD 1.13.4 has sssd-libwbclient as well
>
> >
> >
> > Speaking of sssd-1.14, I cannot build 1.14 with the same dependencies as 1.13,
for instance:
> > configure:21738: error: libhttp_parser missing http_parser_init
> I will take a look
>
> >
> >
> > Gentoo has:
> > net-libs/http-parser-2.6.2
> >
> Did you use special USE flags?
No, it only has static-libs which I have off.
>
>
> >
> >
> > Maybe the deps has been updated? Is here a list with minimum deps for sssd
1.14?
> >
> Meanwhile you can disable secrets responder and thus dependency on
> libhttp_parser + libjansson
libjansson? I don't have that installed(installing now and retrying 1.14 ..., nope:
checking for fakeroot... yes
checking for py.test... no
checking for HTTP_PARSER... no
checking http_parser.h usability... yes
checking http_parser.h presence... yes
checking for http_parser.h... yes
checking for http_parser_init in -lhttp_parser_strict... no
checking for http_parser_init in -lhttp_parser... no
configure: error: libhttp_parser missing http_parser_init
Jocke
>
>
> --without-secrets
>
Will try this next ...
I figured out the http-parser, it was when building 32 bits and http-parser was only built
for 64 bits.
Moving --without-secrets to 32 bits only gets me further:
libtool: link: x86_64-pc-linux-gnu-gcc -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith
-Wcast-qual -Wcast-align -Wwrite-strings -Wundef -Werror-implicit-function-declaration
-Winit-self -Wmissing-include-dirs -fno-strict-aliasing -std=gnu99 -O2 -pipe
-D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -Wl,-O1 -o
.libs/sss_ssh_knownhostsproxy src/sss_client/sss_ssh_knownhostsproxy-common.o
src/sss_client/ssh/sss_ssh_knownhostsproxy-sss_ssh_client.o
src/sss_client/ssh/sss_ssh_knownhostsproxy-sss_ssh_knownhostsproxy.o -Wl,-rpath
-Wl,/usr/lib64 -Wl,--as-needed ./.libs/libsss_util.so -L/usr/lib64 -lldb -ldbus-1 -lpcre
/usr/lib64/libini_config.so /usr/lib64/libpath_utils.so /usr/lib64/libbasicobjects.so
/usr/lib64/libref_array.so /usr/lib64/libcollection.so /usr/lib64/libldap.so
/usr/lib64/liblber.so -lresolv -lsasl2 -lgnutls /usr/lib64/libgcrypt.so -lgpg-error -ltdb
-lglib-2.0
/var/tmp/portage/sys-auth/sssd-1.14.1/work/sssd-1.14.1-abi_x86_64.amd64/.libs/libsss_child.so
/var/tmp/portage/sys-auth/sssd-1.14.1/work/sssd-1.14.1-abi_x86_64.amd64/.libs/libsss_cert.so
/var/tmp/portage/sys-auth/sssd-1.14.1/work/sssd-1.14.1-abi_x86_64.amd64/.libs/libsss_crypt.so
./.libs/libsss_crypt.so -lcrypto ./.libs/libsss_debug.so ./.libs/libsss_child.so -ltevent
/usr/lib64/libdhash.so
/var/tmp/portage/sys-auth/sssd-1.14.1/work/sssd-1.14.1-abi_x86_64.amd64/.libs/libsss_debug.so
-lpthread -ltalloc -lpopt -Wl,-rpath -Wl,/usr/lib64/sssd
libtool: link: x86_64-pc-linux-gnu-gcc -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith
-Wcast-qual -Wcast-align -Wwrite-strings -Wundef -Werror-implicit-function-declaration
-Winit-self -Wmissing-include-dirs -fno-strict-aliasing -std=gnu99 -O2 -pipe
-D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -Wl,-O1 -o
.libs/sss_ssh_authorizedkeys src/sss_client/sss_ssh_authorizedkeys-common.o
src/sss_client/ssh/sss_ssh_authorizedkeys-sss_ssh_client.o
src/sss_client/ssh/sss_ssh_authorizedkeys-sss_ssh_authorizedkeys.o -Wl,-rpath
-Wl,/usr/lib64 -Wl,--as-needed ./.libs/libsss_util.so -L/usr/lib64 -lldb -ldbus-1 -lpcre
/usr/lib64/libini_config.so /usr/lib64/libpath_utils.so /usr/lib64/libbasicobjects.so
/usr/lib64/libref_array.so /usr/lib64/libcollection.so /usr/lib64/libldap.so
/usr/lib64/liblber.so -lresolv -lsasl2 -lgnutls /usr/lib64/libgcrypt.so -lgpg-error -ltdb
-lglib-2.0
/var/tmp/portage/sys-auth/sssd-1.14.1/work/sssd-1.14.1-abi_x86_64.amd64/.libs/libsss_child.so
/var/tmp/portage/sys-auth/sssd-1.14.1/work/sssd-1.14.1-abi_x86_64.amd64/.libs/libsss_cert.so
/var/tmp/portage/sys-auth/sssd-1.14.1/work/sssd-1.14.1-abi_x86_64.amd64/.libs/libsss_crypt.so
./.libs/libsss_crypt.so -lcrypto ./.libs/libsss_debug.so ./.libs/libsss_child.so -ltevent
/usr/lib64/libdhash.so
/var/tmp/portage/sys-auth/sssd-1.14.1/work/sssd-1.14.1-abi_x86_64.amd64/.libs/libsss_debug.so
-lpthread -ltalloc -lpopt -Wl,-rpath -Wl,/usr/lib64/sssd
./.libs/libsss_util.so: undefined reference to `timer_settime'
./.libs/libsss_util.so: undefined reference to `timer_delete'
./.libs/libsss_util.so: undefined reference to `timer_create'
collect2: error: ld returned 1 exit status
Jocke