Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

REST: P: Linus Torvalds S: Buried alive in email -- from /usr/src/linux/MAINTAINERS


devel / comp.protocols.kerberos / Re: Debugging why KRB5_KTNAME isn't working

SubjectAuthor
o Re: Debugging why KRB5_KTNAME isn't workingKen Hornstein

1
Re: Debugging why KRB5_KTNAME isn't working

<mailman.15.1643309175.8148.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=204&group=comp.protocols.kerberos#204

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: ken...@cmf.nrl.navy.mil (Ken Hornstein)
Newsgroups: comp.protocols.kerberos
Subject: Re: Debugging why KRB5_KTNAME isn't working
Date: Thu, 27 Jan 2022 13:45:38 -0500
Organization: TNet Consulting
Lines: 23
Message-ID: <mailman.15.1643309175.8148.kerberos@mit.edu>
References: <4f4a71e295df1a7aa4e53475af50164af7cbe86a.camel@interlinx.bc.ca>
<202201271803.20RI3uW0023229@hedwig.cmf.nrl.navy.mil>
<0d9c6ad8baa23118afb18a9ff82e9ff99a85d7cb.camel@interlinx.bc.ca>
<202201271845.20RIjcB2023687@hedwig.cmf.nrl.navy.mil>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="18969"; mail-complaints-to="newsmaster@tnetconsulting.net"
Cc: kerberos@mit.edu
To: "Brian J. Murrell" <brian@interlinx.bc.ca>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=PaJY9SnNJVU1xebrqMMWzkLS+4HmC3QgS2tgexc/nWCvMGSLknMTBO9wNShafyT3AER2PQ+E8VBhtyn8CJJoaUuRl35lDQheOGUj6HROT7ODBJblOsBlWCBvetPp2ie7FYpmsho6U56zlxO/0JLsjeWGjPtf3KbOzQ1qJqu3x4jSCYGJDwWl+5O6FY493Qvj055ApDFkE44sjTQQOKthNBAKj2hXoK7T5maCwyv6W1iH0AbiVVUiMtWg5cg55Q8BV60lCWhNMzrXVysm5HRr51QpyA3XQYxx9vOUnas1QOPJCqgti58N/NmyrcdXEMCdf5qvQ+HYJN/Aqfdv6QPEMg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=uPtQ7kLG2lYAD3XODB6+cXCgAjMdHWXc8fal09SCqXY=;
b=ATuT/+HEyDIE2W0al8SD1f+NZQcBeB9TeUXL0ulqlNS4YZU3ht87PfPu/3y9l/cgq+w67eY/VYpNN9XQh9XD2dzYrelyKi50YwqKe5mpYFKMS79o0TPHzLGdL6kIh+GMzclWo2hfrxXBVgO/h+67dw1fVSymIHZxY+ijkNmZaq8QxzZpwfjmiWo9cSOgHbFJrHKdJQfe9XIt5AoIWooy0Rd4TFRWK/WXv+xPJgAhA9wDS+O7rNLmI3QQGaUWJcMPu5auL9r6+4AgCpZyMxKTiXK4nn05wQIejI9au1NemBJMuVNW6PZAqQWmaBny/ZDWWaL/CLLcCjXYlDUlBjpQYw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=uPtQ7kLG2lYAD3XODB6+cXCgAjMdHWXc8fal09SCqXY=;
b=fFbI3mUMIhusZLHS1xNMos5U6HgpHYvsEjly2kcX1NkQnb8tGGlDUNfpENDp311sqZSrI9U6twg1ByYi9ZrS1uaqJPPEpMj3w+aepWziLdEVgLzEWAJ0e7olcnQHWtkGWUxA1KjSBYyaJFjnFGuxnvv80tBlJokuaoQgvcfd45A=
Authentication-Results: spf=pass (sender IP is 140.32.59.234)
smtp.mailfrom=cmf.nrl.navy.mil; dkim=pass (signature was verified)
header.d=nrl.navy.mil;dmarc=pass action=none header.from=cmf.nrl.navy.mil;
Received-SPF: Pass (protection.outlook.com: domain of cmf.nrl.navy.mil
designates 140.32.59.234 as permitted sender)
receiver=protection.outlook.com; client-ip=140.32.59.234; helo=mfe.dren.mil;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nrl.navy.mil;
h=message-id : from :
to : cc : subject : in-reply-to : references : mime-version : content-type
: date; s=s2.dkim; bh=uPtQ7kLG2lYAD3XODB6+cXCgAjMdHWXc8fal09SCqXY=;
b=YMubxJuQM+FFRU8cnXUrZBrwVvB5JyjpZppM1j7pi9wPeDNZUXVEiMYjnxWOFRRR8RE4
l5StmTV9mFEKNiEotS66vfU44a98giLC/xYcJZDfMucUvpM33jAW5mOKqp0Fi6d5amcQ
gvpJZrfSrb0SfGrVpKfEKMxNl1NTlXuxRJU7qCHdEVG1rUOFboBs5gGKt9D7EBLiYsPV
vcUiW3UZSi+zdQFyoHBNTnt/hMRYe8mMjTM1PS358NY5VjHLe9FN9+0N3lD3PXf4zsd2
6G8Fn5afMeINPXtbNJgyrrL60IQF6ktBTdD7PVZz+No7xs5WNuJcscsYUxNI6EKOkGYx MA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nrl.navy.mil;
h=message-id : from :
to : cc : subject : in-reply-to : references : mime-version : content-type
: date; s=s1.dkim; bh=uPtQ7kLG2lYAD3XODB6+cXCgAjMdHWXc8fal09SCqXY=;
b=chRT/WGIaKdy8Ca8hnPOkOm2dw+80LJNKqNm5nrgiijkq6esjJwhARTmOPQ61cLMEy+N
gbjQSC6gDqwS5v7Lsa9TVHNWEJRv8kjpUYSHp6/4frrqvGy6FSAY+nlD7X4OFVQI7kiD
xpBX/asASPuJ2HdKo6ibq5KXbnSFAmaTRp0=
In-Reply-To: <0d9c6ad8baa23118afb18a9ff82e9ff99a85d7cb.camel@interlinx.bc.ca>
X-Face: "Evs"_GpJ]],xS)b$T2#V&{KfP_i2`TlPrY$Iv9+TQ!6+`~+l)#7I)0xr1>4hfd{#0B4
WIn3jU;bql;{2Uq%zw5bF4?%F&&j8@KaT?#vBGk}u07<+6/`.F-3_GA@6Bq5gN9\+s;_d
gD\SW #]iN_U0 KUmOR.P<|um5yP<ea#^"SJK;C*}fMI;Mv(aiO2z~9n.w?@\>kEpSD@*e`
X-NRLCMF-Spam-Score: () hits=0 User Authenticated
X-NRLCMF-Virus-Scanned: No virus found
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: fb7b3c27-1516-4bf5-f7fc-08d9e1c53f0a
X-MS-TrafficTypeDiagnostic: SN4PR01MB7406:EE_
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <SN4PR01MB74068A4AAE3DC034F793A4B4AC219@SN4PR01MB7406.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:8882;
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: qioEHOx4saAkA5tCUczfTyjYNKOz2YkS5uNtYhIIIEexbFJ60rPzHYmHP7VwSn4j5cssBWndqQJ/MSjKwqyrQIOjDy4QjTamCQzskP2uacSrb7I+cxPEZNp2Lc8iqH8YuF90ZF8y/SCkbe3ywNbkFWEz9WODu8kNsZ3H6CRbw+AqGWcnORVuIi/O/adslrhGlbj7HlYGBCXzqcbjxy0jhaVtIT2Ewf+XR7m1rfNEaqZvYNzlU/WxGCAL57ZhiuRt5txy39J4HVn1Ae+HcsqBWOm43piVYL5Zq2Eb2socKRC+95wUKaPglKWIAJZgO7AWBT4ryK9tXPnExESu4/m8NAI7BEJ4TL0DOnGxU76gyZK0VokzLB6NKdNYIwt7W149/+xnbGIlUDvim5tcxdGspiGJFmdBi6yhROCM8VdOJmgKNeQ41gUkdbvpG05WdY1EKKDJg1yQiS0a+7P+h+bYcJ3YQ4b2k0c9QT5+spEtjLT6rfkVYJTTZ74IQ7MD7c/YXAKJZeneRupzk3dutGceUYmzPBMkxUdiMY0v7Efzfen48G/lKyAO+G1krgWlsLCP/zPjjEBrXX2TsFTE9V0MmleEsuxYOz1/cCAMyblM/cUiA+z2txqp5LI2Apl6+nL6
X-Forefront-Antispam-Report: CIP:140.32.59.234; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:mfe.dren.mil; PTR:mfe.dren.mil; CAT:NONE;
SFS:(4636009)(1076003)(68406010)(70586007)(336012)(4744005)(356005)(26005)(7596003)(956004)(2906002)(316002)(786003)(5660300002)(4326008)(508600001)(6862004)(426003)(86362001)(8676002)(7636003);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jan 2022 18:45:53.0720 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: fb7b3c27-1516-4bf5-f7fc-08d9e1c53f0a
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT004.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN4PR01MB7406
X-OriginatorOrg: mitprod.onmicrosoft.com
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <202201271845.20RIjcB2023687@hedwig.cmf.nrl.navy.mil>
X-Mailman-Original-References: <4f4a71e295df1a7aa4e53475af50164af7cbe86a.camel@interlinx.bc.ca>
<202201271803.20RI3uW0023229@hedwig.cmf.nrl.navy.mil>
<0d9c6ad8baa23118afb18a9ff82e9ff99a85d7cb.camel@interlinx.bc.ca>
 by: Ken Hornstein - Thu, 27 Jan 2022 18:45 UTC

>> Is it possible Postfix is clearing out the environment at startup?
>
>As anything, I suppose it is possible. It would be doing so in
>violation of exactly the purpose of the mechanism that is being used to
>set the environment though.

Hm. From postconf(5):

import_environment (default: see postconf -d output)
The list of environment parameters that a privileged Postfix process
will import from a non-Postfix parent process, or name=value environ-
ment overrides. Unprivileged utilities will enforce the name=value
overrides, but otherwise will not change their process environment.

Is that what you're using? It looks to me that if the variable isn't
listed in the import_environment configuration entry, it doesn't make
it very far and is removed by the function clean_env().

(If you want to demonstrate to others how KRB5_KTNAME is supposed to
work, just include the output of "env KRB5_KTNAME=/dev/stdout kinit" or
some other Kerberos program).

--Ken

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor