[SSSD] no krb5 cache produced

steve steve at steve-ss.com
Mon Apr 29 13:30:42 UTC 2013


On 04/29/2013 12:55 PM, John Hodrien wrote:
> On Mon, 29 Apr 2013, Ondrej Kos wrote:
>
>> Hi,
>>
>> I'm not sure if I understand your situation correctly, but it seems 
>> to me that this could be solvable by creating a symlink pointing from 
>> /tmp/krb5_cc to /var/lib/sss/db/ccache. We just tried it with Lukas, 
>> and it works as i expected.
Nope, I'm afraid not. The symlink doesn't work. It has to be a real file.
>
> Would SELinux throw a spanner in the works?  I've not needed this for 
> cifs, as
> sec=krb5,multiuser seems to remove the need for the machine credential.
John, that's not what we find. The whole reason we have this problem is 
that for us, nothing gets mounted unless there's a root cache at /tmp 
multiuser or not. Th only reason we use multiuser is to make cifs behave 
like nfs in that the uid:gid who creates the file is that of the user 
who is logged in and not the guy who mounted the share.

It looks like the cron to keep the ticket alive is the way to go and I 
take your point. Hourly seems fine. The idea is that cifs on the client 
stays alive for as long as the box is booted, not until the ticket 
expires. There's aother utility called k5start which may be another 
solution. It's designed to maintain long running processes. I've used it 
with nslcd.
Cheers,
Steve


I think the ony solution



More information about the sssd-devel mailing list