[28257] in Kerberos
Re: NIS => Kerberos/LDAP Migration
daemon@ATHENA.MIT.EDU (Tim Schaab)
Mon Aug 13 17:20:24 2007
Message-ID: <46C0CAF1.1090909@geology.wisc.edu>
Date: Mon, 13 Aug 2007 16:19:45 -0500
From: Tim Schaab <tim@geology.wisc.edu>
MIME-Version: 1.0
To: "Thomas A. La Porte" <Thomas.LaPorte@dreamworks.com>
In-Reply-To: <Pine.LNX.4.63.0708131334240.11848@doubledeckers.anim.dreamworks.com>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Thomas A. La Porte wrote:
> Not sure what you mean when you say that pam-krb5-migrate "doesn't work
> with MIT kerberos."
>
> We used it in our infrastructure to do exactly what you are looking to
> do, and we use MIT Kerberos on Linux.
>
> What problems did you run into?
>
> -- Tom
Part of the problem is trying to get it to actually run on a client
system running Linux, Ubuntu Edgy specifically. It will compile when
heimdal-dev is installed, but won't compile when krb5-dev is installed.
When I build it against heimdal-dev and it tries to run via pam, I get
this error:
###### Log ######
PAM unable to dlopen(/lib/security/pam_krb5_migrate.so)
PAM [dlerror: /lib/security/pam_krb5_migrate.so: undefined symbol:
kadm5_free_policy_ent]
PAM adding faulty module: /lib/security/pam_krb5_migrate.so
###### END ######
I have it configured in PAM in /etc/pam.d/common-auth as follows:
###### /etc/pam.d/common-auth ######
auth sufficient pam_unix.so nullok_secure
auth sufficient pam_krb5.so minimum_uid=2000 use_first_pass
auth optional pam_krb5_migrate.so min_uid=2000
###### END ######
When a NIS user logs in, a Kerberos principal is not created and I get
this in the kadmin log:
###### LOG ######
kadmind[2083](Notice): Miscellaneous RPC error: X.X.X.X, invalid client
handle received
###### END ######
My thoughts on why it is not working is that the kadmin protocols from
MIT Kerberos and Heimdal are not compatible. Since pam_krb5_migrate is
compiled against Heimdal's kadmin code, I think that's where the error
is coming from.
Am I missing something from the pam_krb5_migrate setup?
- --
/*********************************************************\
| Tim Schaab | Computer Facilities |
| 608-262-3738 | tim@geology.wisc.edu |
| UW-Madison | Geology & Geophysics |
\******** GPG Key: http://dev-zero.org/pubkey.asc ********/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFGwMrxCR3ITS1QXGYRAhGZAJ9FfcBxAsu5pP62Nw94bWqGLMBHBACg6xFr
JQ0ow945hlBH75O9uGjrhFI=
=LPMZ
-----END PGP SIGNATURE-----
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
