Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

One Bell System - it used to work before they installed the Dimension!


devel / comp.protocols.kerberos / Re: Debugging why KRB5_KTNAME isn't working

SubjectAuthor
o Re: Debugging why KRB5_KTNAME isn't workingSimo Sorce

1
Re: Debugging why KRB5_KTNAME isn't working

<mailman.20.1643316818.8148.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=209&group=comp.protocols.kerberos#209

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: sim...@redhat.com (Simo Sorce)
Newsgroups: comp.protocols.kerberos
Subject: Re: Debugging why KRB5_KTNAME isn't working
Date: Thu, 27 Jan 2022 15:53:10 -0500
Organization: Red Hat
Lines: 43
Message-ID: <mailman.20.1643316818.8148.kerberos@mit.edu>
References: <4f4a71e295df1a7aa4e53475af50164af7cbe86a.camel@interlinx.bc.ca>
<786a0a7b-2d3c-f016-a32c-c8e8c21f7a6c@mit.edu> <83zgnh2cxe.fsf@jochen.org>
<91d4b70f6566927b0f81102193232ef8f330981a.camel@interlinx.bc.ca>
<e144edcc40c76d8a0110eb21702dc94274da71c2.camel@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="11759"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Evolution 3.40.4 (3.40.4-2.fc34)
To: "Brian J. Murrell" <brian@interlinx.bc.ca>, kerberos@mit.edu
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=YjODYAJpb6W9EQRee0LldaK3DPG2Ae0jhLiAZc+GIndQJInNzn1pnJvzqt3Rx8yhf6K1YDUQ4RQhH/tUOdM+PYnUkLmYddxKZfX1fApfTYvMcKVRp0ctsZKOQxvJA2D/SSAoNP8d2El8jYHyPvQdZwvivNa/rvSmhaw3D2HUs1s3tsQmjsYKKgUEGVuBLpcV9tZyl4NtmUQUgEdDTNxpWqfFmbmmt1uYlw9Vo0VFvL9FvPYuwBvQUzXl9rGbpytr1/wYxNhibAdpG8wu3mOdve+h0dCk4AE0y18gIWigo3sYT5EZAW7eo0+MoPMoC6U6r7yGEIc8zjzuiHzSXr2L9w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=RvpvdVIUUbSfPIl+K7QSKLZAZUXxtKvWYW7pjuS+Vys=;
b=ZprhxNx2y0AZhpNvN2Djq8Pju8JNNQOfNFjIU0qR5+QcZmKr0FDHdK5LWcgNWY7A9QZA6S/UCi/Km/0o8od+I7VXrMlCHqo3GCfh92VJDg4LUHco7gglIBg41TxVUy/+6D5k6+4Ty/BOWNJ+9Rl+DL7P7+evTGatupmpmXZ28PVGnCGjjXB3wrP44zqAxxPI33h1JCXHpoA7mydPjdkPoD/7RtgmYEVRlHCSuHv0UYMi4jAZhiCgeiJ44WvT/oA+Aj45NYhGkQeQ6dgMVBYVGZMqpjUSqxKfFCL+o2K4cPFZsERMHiuF/zopF9oyc6vplPryIHA7Wi1Y41zWIcGkUQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
170.10.133.124) smtp.rcpttodomain=mit.edu smtp.mailfrom=redhat.com;
dmarc=pass (p=none sp=none pct=100) action=none header.from=redhat.com;
dkim=pass (signature was verified) header.d=redhat.com; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=RvpvdVIUUbSfPIl+K7QSKLZAZUXxtKvWYW7pjuS+Vys=;
b=qOY/6cyDD9LgXUpQ3Z2ABtqSM5poiC15qz754mNV3NwMSdcKZne3tc0LiyILH9T7VW0xmt0valMy333q73lpbeUc4aXYz+EeIPB8qE1TO2QojrjqQJru4wgeIINFFW1bmuPKk9h0JNmgeeQYWGc0TtVsLFVZ0e2w6oizjBcNljA=
Authentication-Results: spf=pass (sender IP is 170.10.133.124)
smtp.mailfrom=redhat.com; dkim=pass (signature was verified)
header.d=redhat.com;dmarc=pass action=none header.from=redhat.com;
Received-SPF: Pass (protection.outlook.com: domain of redhat.com designates
170.10.133.124 as permitted sender) receiver=protection.outlook.com;
client-ip=170.10.133.124; helo=us-smtp-delivery-124.mimecast.com;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;
s=mimecast20190719; t=1643316795;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding:
in-reply-to:in-reply-to:references:references;
bh=RvpvdVIUUbSfPIl+K7QSKLZAZUXxtKvWYW7pjuS+Vys=;
b=CD2CiYa/cQAaeVruPxandXH3M4coPpYQzgI8KPJ8qdRVM5PtNntfvbQcC2LHrUrDWwzCkH
R3XhrvGIYxW+HwuQIsBU9UupG+Mv9KnkN+3GWADGCoMs0lcWcWOagqL7sJtdQPMcCWhLR0
bGZd4yHhN4Y+Mvkwxcuc6UYnCSlvjSE=
X-MC-Unique: _8SVjVRxP-O4woXS8-4wTQ-1
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:message-id:subject:from:to:date:in-reply-to
:references:organization:user-agent:mime-version
:content-transfer-encoding;
bh=RvpvdVIUUbSfPIl+K7QSKLZAZUXxtKvWYW7pjuS+Vys=;
b=jCnZust5P0zTu17Sg3PbUExilSYrvCH5vi8A33gYY0qDGpvQwiJFBGHZnZKVLmE/zQ
kxXC7d29R5CyHJvxmXIoO78yTXrtjCTa00cQA9CA/DELxDld0vMESAUCT7Lo3tWB34Zd
kttlRNHqNrEan8XRQItVf2O5GBYYbTCTn1nZdB62vK4iEKeHle7y9E7l6P3kPVA81ilw
h4TY1VfFcGskAMQSX//XdXiv/cUs8GlKD6NIikBX/FklWlu/dCUoAgS61CJqiTv8ra+n
iorTNOm9r8PQN3vLcSHB+uBPzdL8rNlDTWkbX8G4JaLzlrdDvA7P5tommQlxFuRubkVW
mJtg==
X-Gm-Message-State: AOAM531jvrH1vFllGTxyHvVIllSmVxoxZ7dFqkJu3/elnei+amc5k639
pEldcejj9e11HmFC36BUkFaz3m9JhtENmiuyDYFKhXIWVnlrfDMCD/xvU8e2XPEeL7UsSp7yScr
5gAwx4i7S
X-Received: by 2002:a05:6602:2209:: with SMTP id
n9mr3345545ion.106.1643316792294;
Thu, 27 Jan 2022 12:53:12 -0800 (PST)
X-Google-Smtp-Source: ABdhPJwbXql7hHPeQ5Qqv/b7r+fcEK3dpwHduoEbZEuCoZ5Sf9FeqONYjaxBkemEdoIdjPFHAyrtaA==
X-Received: by 2002:a05:6602:2209:: with SMTP id
n9mr3345513ion.106.1643316791703;
Thu, 27 Jan 2022 12:53:11 -0800 (PST)
In-Reply-To: <91d4b70f6566927b0f81102193232ef8f330981a.camel@interlinx.bc.ca>
Authentication-Results-Original: relay.mimecast.com; auth=pass
smtp.auth=CUSA124A263 smtp.mailfrom=simo@redhat.com
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 49351442-02a4-41bb-aed1-08d9e1d70b15
X-MS-TrafficTypeDiagnostic: SN6PR0102MB3566:EE_
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <SN6PR0102MB356697CDB44C670BD50EA980A3219@SN6PR0102MB3566.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:8882;
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: cKvh3qdUOUiv1iSiHApNXIN7PeKaR8oVijefY+LyWulh/VzGUxJsiZOw80Pbj4zpE3ZQIm0goJhTcnyGbQ+Yq04LRHsnecPh/HOmXYYDlYk4I6eNiqRXqcWYVKO6HEU7WWJtz36bbRpqJqN+tcChHAmdUg1VcRGEfEkTAJGCHtaOS9Wm5PQjsPOfRygsYAXAXAEQ3+AhJbkxZ2qzggBqlSi4bBVfJ1tdFuRD9Jrp02+UJhe+rn+00t+WNFUNFxWLyP0bxIESSVuMf3IDb/6XO8qCKJepG6vIwzndjl3GWjysGrY122oyFjjKN7p7DJD+RjOVS+MSln+OFJ9fRrR8oyg/67iS9t/rwJGLxPYRqeKRLiKaBta+bzN6vq+1vgxIvedmdCSnrk9hhwh8OHcRj+SHFYbPdCImHI4fdSSKJ014TZiYMY837nUqy+P7tORQ81Yu64mPEBXJlHt4a3/bUI6xc17qI3i2aMkyssP9EyHAD9Iz12YQzntdEAktx+WdbGvFBWDgSLwDKkK8Gx2B0eHpOgP93jwXwEBVHCYMdEB2xAtd8CJpvyP/povZ5StFpGPoKbDDjiYq/TsGfU8HhAufYw/PcUhE3pQaN8QihCQYtn62Goben/zzHJKSk/VJ
X-Forefront-Antispam-Report: CIP:170.10.133.124; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:us-smtp-delivery-124.mimecast.com;
PTR:us-smtp-delivery-124.mimecast.com; CAT:NONE;
SFS:(13230001)(4636009)(508600001)(83380400001)(7636003)(316002)(786003)(86362001)(68406010)(8676002)(336012)(70586007)(5660300002)(36756003)(2616005)(7696005)(36916002)(356005)(7596003)(26005)(2906002)(956004)(20210929001);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jan 2022 20:53:16.7637 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 49351442-02a4-41bb-aed1-08d9e1d70b15
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT016.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR0102MB3566
X-OriginatorOrg: mitprod.onmicrosoft.com
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <e144edcc40c76d8a0110eb21702dc94274da71c2.camel@redhat.com>
X-Mailman-Original-References: <4f4a71e295df1a7aa4e53475af50164af7cbe86a.camel@interlinx.bc.ca>
<786a0a7b-2d3c-f016-a32c-c8e8c21f7a6c@mit.edu> <83zgnh2cxe.fsf@jochen.org>
<91d4b70f6566927b0f81102193232ef8f330981a.camel@interlinx.bc.ca>
 by: Simo Sorce - Thu, 27 Jan 2022 20:53 UTC

On Thu, 2022-01-27 at 15:34 -0500, Brian J. Murrell wrote:
> On Thu, 2022-01-27 at 20:31 +0100, Jochen Kellner wrote:
> >
> > I once configured postfix to uses sasl:
> >
> > main.cf:83:smtpd_sasl_auth_enable = yes
>
> I do have that already.
>
> > And inĀ  /etc/postfix/sasl/smtpd.conf:
>
> Hrm. I don't have this file. But I never did and this all worked
> prior to a few days ago when the machine was upgraded from EL7 to EL8,
> which unsurprisingly upgrades a lot of things in big jumps. So maybe
> this is now necessary.
>
> Ahh. Looking at smtpd's strace output, it seems it's looking in
> /etc/sasl2/smtpd.conf on my machine and I do have that file with:
>
> pwcheck_method: saslauthd
> mech_list: gssapi plain login
>
> > keytab: /etc/smtp.keytab
>
> And indeed, winner winner, chicken dinner! Adding a "keytab:
> /etc/postfix/smtp.keytab" to that file is making smtpd use the correct
> keytab file now.
>
> So this must all be new behavior in some upgraded versions.

The keytab option for the cyrus-sasl gssapi plugin is somewhat new
(considering that RHEL-8 is almost 3 years old now) and is probably
causing the change in behavior wrt environment variables that you are
experiencing.

--
Simo Sorce
RHEL Crypto Team
Red Hat, Inc


devel / comp.protocols.kerberos / Re: Debugging why KRB5_KTNAME isn't working

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor