Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

"I take Him shopping with me. I say, 'OK, Jesus, help me find a bargain'" -- Tammy Faye Bakker


devel / comp.protocols.kerberos / unexpected failure for GSS Pg server

SubjectAuthor
o unexpected failure for GSS Pg serverMatt Zagrabelny

1
unexpected failure for GSS Pg server

<mailman.27.1644342897.8148.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=217&group=comp.protocols.kerberos#217

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: mzagr...@d.umn.edu (Matt Zagrabelny)
Newsgroups: comp.protocols.kerberos
Subject: unexpected failure for GSS Pg server
Date: Tue, 8 Feb 2022 11:54:13 -0600
Organization: TNet Consulting
Lines: 56
Message-ID: <mailman.27.1644342897.8148.kerberos@mit.edu>
References: <CAOLfK3WxoVrNQdwjtoM9tv1ED_6c5C8vAWDB38OVWZBYTnV9Lg@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="5615"; mail-complaints-to="newsmaster@tnetconsulting.net"
To: kerberos <kerberos@mit.edu>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=KIrLp0I3sTq//lQzplPKiJvEs1z+Ox3ZrugVVCC1L9AGsMUQ1S7lU12TQWlYlgw1LYt44PlIx34tOCdwh4vXuVxdsxtDsSztGUZGuHb7vFeE3S4APZhYOqMXgDdWzw3k3oEdhnrtjWO0U1Vw55Q4j5/Exhv0KV+qMUbEe//p13uVvlLZhBakecwbQdGmxOP53+dDttTfHx26nUH++fCND/h3tMGjLZbqyxuG0DdPMKc9VHeEeHmYYGYwxmV+x7okGrhp/U1ALNVTlejn4qI4/2nuiVvHIZNtojrGR0TbTNN/57MvvN9BpWGPNSJf6E3Z88YcXSHpMoxMeCmiNDXrPw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=FVyWEYwChPfxaevVLh5isuT6VpoIOr05CNUL+eLEP84=;
b=FLpHSFrq+s9MIGTOaJQkRO/ZWQkSCwniN1Tygzoygu7f6eBORwr0GcSK0JQe06UzEphkmfh2wfHO7ubnl/7P2bsj2T+Ziso81CfC2RoKWphEjfISWuWeqfoW3ip9EpywPLl4Tl/RxZYsrJB7htScnM2pVT78ipnLCDSELUkX5HuxA2CkiG2kfAtmUhWIh6t+gB7nWbYscmwjyozzgSGwgYzkRlxB4fhl0QuiuCLtoMX1tNuiC+MgoD5fsTrqxEsyRwzuMAnOr/Lnk2C4vAqi89c2yKCgBKAQ9pNjrC/+pfhJqNgujjgJ1t/hBfnRSEr6p2lWOrzW2q1v7rEG7mhp1A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
134.84.196.208) smtp.rcpttodomain=mit.edu smtp.mailfrom=d.umn.edu; dmarc=pass
(p=reject sp=reject pct=100) action=none header.from=d.umn.edu; dkim=pass
(signature was verified) header.d=d.umn.edu; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=FVyWEYwChPfxaevVLh5isuT6VpoIOr05CNUL+eLEP84=;
b=B7s/q+P+vrD2ia5sCRN8L8sZZYIvpT6FRwbtbf280gDwHmz3+gOkvk0H+UpFfUjmEZ9J+8qrL3yNVEp2fRMUjR0WPW07bPof1U7+wX6ZcKlC4/jEIU/tnMGKWwB85siY5jEKPn1mC3Rl2IATrJTdmjN0/aJ/HLFRKiSCePhiJRo=
Authentication-Results: spf=pass (sender IP is 134.84.196.208)
smtp.mailfrom=d.umn.edu; dkim=pass (signature was verified)
header.d=d.umn.edu;dmarc=pass action=none header.from=d.umn.edu;
Received-SPF: Pass (protection.outlook.com: domain of d.umn.edu designates
134.84.196.208 as permitted sender) receiver=protection.outlook.com;
client-ip=134.84.196.208; helo=mta-p8.oit.umn.edu;
X-Virus-Scanned: amavisd-new at umn.edu
DMARC-Filter: OpenDMARC Filter v1.3.2 mta-p8.oit.umn.edu 4JtVy922CHz9vKMX
DKIM-Filter: OpenDKIM Filter v2.11.0 mta-p8.oit.umn.edu 4JtVy922CHz9vKMX
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=d.umn.edu; s=google;
h=mime-version:from:date:message-id:subject:to;
bh=FVyWEYwChPfxaevVLh5isuT6VpoIOr05CNUL+eLEP84=;
b=gF0Ua3Owaey9FdUrlHPvq5z4Z2HlDIpvaoEL00NsGYwPVTynIMC6weyQ5deHE3S9Nn
n3RlsAshtnO1YolFoMJuDR00FEuyK6/RiZIBVKs0KKZNTs1/5vXHSDVfavylIe7pvXqc
ULU7Qbvy5QE26/i69Pz46CsDn/XC5NIwD8H0oasyUv6WI8k7XH/qBbYoGCtNJ/je339z
b9gMx60SGmA5nm3wtKjT5DHQKqAg/uzX/INBi813wkH0PN2FMmQD9ECuvyW5i5lqa+ZJ
MaQnaI7e4uhDOzK2zp2ybTX9SUjmMEFYXmApYvsHWcqNetGBENZV7ErW6ytItCImrSwD
78dQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=FVyWEYwChPfxaevVLh5isuT6VpoIOr05CNUL+eLEP84=;
b=O0ttJoods9d0mWdYubPYxY0+j78+87s2C27xGqQ6uFCZDmbxheTHlPHm+QPHY62oKZ
7NwQfcrwdWsOcDH6LW49vanVpv1xOyej38eQGP8dkTEydowCukKGMPD/EvDPusq6pIIq
NRPVYXaotbWMoE6q0lXXFhiw1DlDToXm2yn86V0OVmueysuI6O+cSBpeOqDTmFmlvDRv
nZpb9btn0l80UWEhnaxYCZNA38qgx/KslDuQg4aTiix3oTEmiJoDaA5T/17cpL7phdA+
llLQBy+R9nbSnqc31In0TBVCUIuHhSaTK/CLjo9EPbaGMKACDpXenRDY+pVg+/NGJQrA
PFHA==
X-Gm-Message-State: AOAM530t+1OsNa0CPypuZr4mLsi0Y5DBrCEibRfM3bfyAunwHhDcGS9w
xinToYYx59bd1Mx7bk5RMo8EfaeDkEBNinN71owk0kYm15McHZQ2OleocpHJnAl0rL1OpB+2375
liKZgRoiZFHs+xxa2I+TWlpudDrhv
X-Received: by 2002:a05:620a:1671:: with SMTP id
d17mr3360408qko.683.1644342864593;
Tue, 08 Feb 2022 09:54:24 -0800 (PST)
X-Google-Smtp-Source: ABdhPJzLdx6kJn7BthLz6RdfOmytdWuHUrlLHpmuYhAMmASogzArl4QHMayYNn0PA6gGkYzLXnZMT7f+eSEVGVjrZVM=
X-Received: by 2002:a05:620a:1671:: with SMTP id
d17mr3360398qko.683.1644342864292;
Tue, 08 Feb 2022 09:54:24 -0800 (PST)
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 991dbc45-9914-4b24-676a-08d9eb2c0bd7
X-MS-TrafficTypeDiagnostic: MWHPR0101MB3005:EE_
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <MWHPR0101MB3005B6ABA0B28B4C03188517992D9@MWHPR0101MB3005.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:9508;
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: Hvogl9Lh3nzasI+LdefepMF5rtNR0jW7VykRLFxw+0/6omYkDCRDmnNgcCC3UgZtJg5/jeVjc6CPhzNz11Vgoc//qs01cccyTpBkItItV51dM38245uMWo7EDl0hLsEeewsS2GSfh/ic2M4rGHZFpVad/Hw29NuZwZqk6NxeFgLdpVddbFW8ZOP4XTva7EQZMD5KxCPafR5XYohBe7S+dbIGWBMaqfrjdl/8FAXWM6UvIFsK+k7eNTo0NXiUhIF4QU477bdw/irghTOnckNYgzd2mkIvLWwwaAdBJ8q5cuOg12AK2W4IRg0lCPpOqJ1kIuxXS0EeVyMgR0Lxxoz/r5aQvyuybUuo/nT4N9ENUrhaAGz/heO42EjIAyJTZp5Acjdcs4X1Ws3cSsg3niQ5xHrdNv0MlIjldzvJb3QO629n/pYjqActY9WI57K6kdgsrJ0BfV6lb3UwBRepi6QTPai2CtsNVbZOJnDLvyQjVm4/oD27xTSEeuKFw7sqGaBgXNw45gRqzKInaSBWU8Xp4DbIhdHzSmtsDr+3O6xOFn+9hEBsdSPdhPjQbtKAYYF6yCuPivK+I0qhS9QK+BFn1A+GWIA8NZPeR1eyqk6O0BkcnNGYw+F38hcJoRFVsGJ9
X-Forefront-Antispam-Report: CIP:134.84.196.208; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:mta-p8.oit.umn.edu; PTR:mta-p8.oit.umn.edu; CAT:NONE;
SFS:(13230001)(4636009)(26005)(6666004)(2906002)(336012)(5660300002)(6862004)(8676002)(70586007)(75432002)(508600001)(68406010)(42186006)(786003)(55446002)(86362001)(7596003)(33964004)(9686003)(316002)(83380400001)(356005);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Feb 2022 17:54:25.8452 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 991dbc45-9914-4b24-676a-08d9eb2c0bd7
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT023.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR0101MB3005
X-OriginatorOrg: mitprod.onmicrosoft.com
X-Content-Filtered-By: Mailman/MimeDel 2.1.34
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <CAOLfK3WxoVrNQdwjtoM9tv1ED_6c5C8vAWDB38OVWZBYTnV9Lg@mail.gmail.com>
 by: Matt Zagrabelny - Tue, 8 Feb 2022 17:54 UTC

Greetings,

I'm experiencing a failure between a GSS enabled Postgresql server and my
CLI client.

To my knowledge nothing has changed on the system to create this failure. I
did modify some puppet configs, but according to the puppet log output (and
stat'ing /etc/postgresql-common/krb5.keytab) file contents did not change.

Here are the errors on on the Pg side:

2022-02-08 11:29:59.304 CST [19401] [unknown]@[unknown] FATAL: unsupported
frontend protocol 1234.5680: server supports 2.0 to 3.0
2022-02-08 11:29:59.315 CST [19402] mzagrabe@somedb FATAL: accepting GSS
security context failed
2022-02-08 11:29:59.315 CST [19402] mzagrabe@somedb DETAIL: Unspecified
GSS failure. Minor code may provide more information: Request ticket
server postgres/db.example.com@EXAMPLE.COM kvno 3 not found in keytab;
keytab is likely out of date

NOTE: I still have some Pg servers where my GSS authentication is not
failing. On those systems, Pg still logs the first line above: "unsupported
frontend protocol 1234.5680: server supports 2.0 to 3.0". I only included
it above for full disclosure.

Here is the error on the client side:

GSSAPI continuation error: Unspecified GSS failure. Minor code may provide
more information: Key version is not available

Here is what klist has to say...

Valid starting Expires Service principal
02/08/2022 11:10:57 02/08/2022 21:10:57 krbtgt/EXAMPLE.COM@EXAMPLE.COM
renew until 02/09/2022 11:10:46
02/08/2022 11:11:05 02/08/2022 21:10:57 postgres/
db.example.com@EXAMPLE.COM
renew until 02/09/2022 11:10:46

Looking at the krb5kdc logs, I see no differences between successful GSS Pg
auths and the failure mentioned above:
Feb 8 11:36:42 auth krb5kdc[434]: TGS_REQ (8 etypes {18 17 20 19 16 23 25
26}) [IPV6 redacted]: ISSUE: authtime 1644340257, etypes {rep=18 tkt=18
ses=18}, mzagrabe@EXAMPLE.COM for postgres/db.example.com@EXAMPLE.COM
Feb 8 11:36:42 auth krb5kdc[434]: closing down fd 14
Feb 8 11:42:45 auth krb5kdc[434]: TGS_REQ (8 etypes {18 17 20 19 16 23 25
26}) [IPV6 redacted]: ISSUE: authtime 1644340257, etypes {rep=18 tkt=18
ses=18}, mzagrabe@EXAMPLE.COM for postgres/
successful.example.com@EXAMPLE.COM
Feb 8 11:42:45 auth krb5kdc[434]: closing down fd 14

Does anyone have any ideas of where to look to start to debug this issue?

Thanks for any help!

-m

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor