[SSSD] no krb5 cache produced

steve steve at steve-ss.com
Mon Apr 29 20:43:46 UTC 2013


On 29/04/13 19:11, Dmitri Pal wrote:
> On 04/29/2013 09:30 AM, steve wrote:
>> On 04/29/2013 12:55 PM, John Hodrien wrote:
>>> On Mon, 29 Apr 2013, Ondrej Kos wrote:
>>>
>>>> Hi,
>>>>
>>>> I'm not sure if I understand your situation correctly, but it seems
>>>> to me that this could be solvable by creating a symlink pointing
>>>> from /tmp/krb5_cc to /var/lib/sss/db/ccache. We just tried it with
>>>> Lukas, and it works as i expected.
>> Nope, I'm afraid not. The symlink doesn't work. It has to be a real file.
>>> Would SELinux throw a spanner in the works?  I've not needed this for
>>> cifs, as
>>> sec=krb5,multiuser seems to remove the need for the machine credential.
>> John, that's not what we find. The whole reason we have this problem
>> is that for us, nothing gets mounted unless there's a root cache at
>> /tmp multiuser or not. Th only reason we use multiuser is to make cifs
>> behave like nfs in that the uid:gid who creates the file is that of
>> the user who is logged in and not the guy who mounted the share.
>>
>> It looks like the cron to keep the ticket alive is the way to go and I
>> take your point. Hourly seems fine. The idea is that cifs on the
>> client stays alive for as long as the box is booted, not until the
>> ticket expires. There's aother utility called k5start which may be
>> another solution. It's designed to maintain long running processes.
>> I've used it with nslcd.
> Have you looked at GSS proxy?
> It goal is to provide the separation of duties and automatic ticket
> renewal. It is in F19 now.
> https://fedoraproject.org/wiki/Features/gss-proxy
> This is the direction we are going to solve the problem of the ticket
> renewal.
Thanks for that. I'll certainly have a look. Anything would be better 
than our roll your own cron.hourly kinit workaround.
Cheers and thanks fr all the help.



More information about the sssd-devel mailing list