[SSSD] krb5 ticket renewal via gnome-screensaver not working
Simo Sorce
ssorce at redhat.com
Sun Nov 15 15:45:53 UTC 2009
On Sun, 2009-11-15 at 08:22 -0500, Brian J. Murrell wrote:
> On Wed, 2009-11-11 at 19:03 -0500, Simo Sorce wrote:
> >
> > I have tested this yesterday (with git master), if you set FILE:%
> > d/krb5cc_%U sssd will happily refresh the crdentials at screen unlock.
>
> Ahhh. ~light bulb goes on~ I am finally coming around to what you are
> saying. Wow. It's even more broken than I had feared.
>
> Certainly that the ccache filename gets regenerated on each
> authentication is very not so nice. Even if each "session" had a
> separate ccache courtesy of the _XXXXXX, it's imperative that each login
> session (including klist, kinit, gnome-screensaver via sssd, etc.) all
> use the same ccache file, all of the time.
>
> However, that said, I have tried removing the _XXXXXX uniqueness from
> the ccache filename but that does not alleviate my issue here. I now
> have:
>
> krb5_ccachedir = /tmp
> ; krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
> krb5_ccname_template = FILE:%d/krb5cc_%U
>
> And yet I am still getting ccache files with the _XXXXXX postfix on
> them. I have even rebooted completely to ensure that there is nothing
> hanging around in memory causing this.
Brian, I told you 4 messages ago on this same very thread that the doc
is wrong and the option is called krb5_ccname_tmpl, in the version you
are using.
It has been corrected and now it is called krb5_ccname_template only in
master.
> > Because sssd is generating a new one each time for now (yes it's a bug).
>
> Yeah, just coming around to that concept. Sorry for being so dense.
>
> > Well I think people were worried that using a predictable name (krb5cc_%
> > U) could be used by malicious user to mount symlink race attacks. We
> > have just copied what is already an available scheme for the krb5
> > libraries, although we might switch to a default of FILE:%d/krb5cc_%U
> > for the 1.0 release to avoid issues.
>
> Hrm. Yeah. On my non-sssd (pam_krb5) machine here, it's also a krb5cc_
> %U_XXXXXX based filename, but everything here in an entire gnome-session
> is using the same file, over and over again.
Which is the right thing to do.
> But I also note that on my non-sssd machines, every process has a
> KRB5CCNAME environment variable, very likely simply through inheritance
> from the process that started the entire login session.
Yes that's how it works.
> sssd logins don't seem to be setting this variable for the children to
> inherit which is likely the root of all of this issue. Even a simple
> ssh->sssd->bash does not populate the environment with a KRB5CCNAME
> variable.
It should be set by pam_sss, if it is not, please open a bug, and assign
it to Sumit (sbose)
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list