Home / user-30020

Rilindo's questions

Martin Hope
Rilindo
Asked: 2016-06-30 06:55:19 +0800 CST
  • 0

I am currently experimenting with deploying using Packer’s Ansible local provisioning and for some odd reason, it doesn’t appear to be executing the tasks in the playbook. Packer, after installing the pre-requiresites for Ansible, uploads the following:

Inventory file (“hosts”)

[localhost]
localhost ansible_connection=local

And the playbook file (“local.yml”):

---
- hosts: localhost
  connection: local
  become: yes
  become_method: sudo
  tasks:
  - name: Making sure that ansible is actually executing this playbook
    shell: echo "hello world"
  - name: install packages
    package: name={{ item }} state=present
    with_items: 
      - nginx
      - git
      - curl
      - libmysqlclient-dev
      - libmysqlclient18
      - mysql-common
      - nodejs
      - tcpdump

The output is as follows (running Ansible against a Ubuntu 14.04 instance):

    amazon-ebs: Executing Ansible: cd /tmp/packer-provisioner-ansible-local && ANSIBLE_FORCE_COLOR=1 PYTHONUNBUFFERED=1 ansible-playbook /tmp/packer-provisioner-ansible-local/local.yml -c local -i /tmp/packer-provisioner-ansible-local/hosts
==> amazon-ebs: Stopping the source instance...
==> amazon-ebs: Waiting for the instance to stop.

As you can see, there is no Ansible output, which I assume I should get (somebody correct me if I am wrong).

I did manual run of the playbook, which worked successfully. At this point, I am not sure if I missing something or not.

ansible packer amazon-ami
Martin Hope
Rilindo
Asked: 2012-04-29 13:55:31 +0800 CST
  • 1

I am trying to setup mcollective using RabbitMQ. Per instruction, I enabled rabbit_stomp plugin and then set the port to 6163:

[ {rabbit_stomp, [{tcp_listeners, [{"127.0.0.1",6163}]} ]} ].

However, even after a restart, it does not seem to want to set it to that port.

tcp        0      0 0.0.0.0:54949               0.0.0.0:*                   LISTEN      13439/beam.smp      
tcp        0      0 :::5672                     :::*                        LISTEN      13439/beam.smp      
tcp        0      0 :::61613                    :::*                        LISTEN      13439/beam.smp

in looking through the web, the above code seems to be the appropriate step, so what I am I missing.

I am running the following:

[root@trp08-01 rabbitmq]# rpm -qi rabbitmq-server
Name        : rabbitmq-server              Relocations: (not relocatable)
Version     : 2.8.1                             Vendor: (none)
Release     : 1                             Build Date: Thu 22 Mar 2012 10:52:25 AM EDT
Install Date: Sat 28 Apr 2012 04:33:31 PM EDT      Build Host: release-debian.localdomain
Group       : Development/Libraries         Source RPM: rabbitmq-server-2.8.1-1.src.rpm
Size        : 3320919                          License: MPLv1.1
Signature   : DSA/SHA1, Thu 22 Mar 2012 10:55:48 AM EDT, Key ID f7b8cea6056e8e56
URL         : http://www.rabbitmq.com/
Summary     : The RabbitMQ server
Description :
RabbitMQ is an implementation of AMQP, the emerging standard for high
performance enterprise messaging. The RabbitMQ server is a robust and
scalable implementation of an AMQP broker.
[root@trp08-01 rabbitmq]# rpm -qi erlang
Name        : erlang                       Relocations: (not relocatable)
Version     : R14B                              Vendor: Fedora Project
Release     : 03.3.el5                      Build Date: Sun 07 Aug 2011 06:21:28 AM EDT
Install Date: Fri 27 Apr 2012 10:50:55 AM EDT      Build Host: x86-11.phx2.fedoraproject.org
Group       : Development/Languages         Source RPM: erlang-R14B-03.3.el5.src.rpm
Size        : 31472                            License: ERPL
Signature   : (none)
Packager    : Fedora Project
URL         : http://www.erlang.org
Summary     : General-purpose programming language and runtime environment
Description :
Erlang is a general-purpose programming language and runtime
environment. Erlang has built-in support for concurrency, distribution
and fault tolerance. Erlang is used in several large telecommunication

On CentOS 5.5

rabbitmq centos5 mcollective
Martin Hope
Rilindo
Asked: 2012-03-31 07:38:57 +0800 CST
  • 0

I am trying to build ntgs from the latest source, using the .spec from rpmforge - as non-root via rpmbuild. During the compile, it fails at this step:

checking for GNUTLS... no
configure: error: ntfsprogs crypto code requires the gnutls library.
error: Bad exit status from /var/tmp/rpm-tmp.78913 (%build)

However, I can compile it successfully outside of rpmbuild. So it sounds like it just the matter of library being seen during the build. However, I can confirm that rpmbuild can see the library that gnutls resides:

[foo@bar ~]$ rpmbuild -E '%{_libdir}' rpmbuild/SPECS/ntfsprogs.spec 
/usr/lib

Library location:

[foo@bar ntfs-3g_ntfsprogs-2012.1.15]$ /sbin/ldconfig -p | grep -i gnutls
        libgnutls.so.13 (libc6) => /usr/lib/libgnutls.so.13
        libgnutls.so (libc6) => /usr/lib/libgnutls.so
        libgnutls-openssl.so.13 (libc6) => /usr/lib/libgnutls-openssl.so.13
        libgnutls-openssl.so (libc6) => /usr/lib/libgnutls-openssl.so
        libgnutls-extra.so.13 (libc6) => /usr/lib/libgnutls-extra.so.13
        libgnutls-extra.so (libc6) => /usr/lib/libgnutls-extra.so

What would cause the problem of the library not being seen when you build a RPM?

EDIT: Oh yeah, I am running Centos 5.5.

rpm gnutls
Martin Hope
Rilindo
Asked: 2012-03-30 07:07:24 +0800 CST
  • 3

We ran into a problem when a set of PVs were added without using the appropriate metadata size. Consequently, we cannot add and remove volumes, create or remove snaps, run vgreduce and pvmoreve or any almost any other LVM command without getting this message:

Metadata too large for circular buffer

In my research, it came down to this:

http://www.redhat.com/archives/linux-lvm/2011-March/msg00046.html

  • Restore from backup configuration
  • Create a new volume group and migrating the LVMs.

I am not enthused about the first option, but the second option is almost worse because we have about over 10 terabytes of data to move.

What other alternatives we can try? Note that we did attempt to use the file-based metadata option, but for some reason, lvm is ignoring that.

Platform: CentOS 5.7

linux centos lvm
Martin Hope
Rilindo
Asked: 2012-03-02 07:25:02 +0800 CST
  • 2

I ran into an interesting error when attempting to address a particular problem.

We had an issue where we have to move the extents over to new physical volumes because the metadata size was too small (255 sectors or 128k). We have increased the pvmetadatasize in /etc/lvm.conf to 32768 and use the size of 4K for the metadatasize on the new physical volumes, so we believe are good in that aspect. But then, as we were moving the last couple of volumes (they were about 500 gigs of data per volume), we ran got this error:

metadata too large for circular buffer

Which is curious, given the setting we made. We did eventually worked around the problem by re-running the pvmove command on to the various volumes until we moved on the data, though.

Looking at the man page, we see this:

1. A temporary pvmove logical volume is created to store details of all the data movements required.

My question is: Which default metadata size is used during the pvmove process? Is it the source PV, the destination PV or setting used in /etc/lvm.conf?

The systems are running CentOS 5.6, and most of the volumes we used are around 500 Gigs per PV.

centos lvm pvmove metadata
Martin Hope
Rilindo
Asked: 2011-12-22 18:08:18 +0800 CST
  • 2

I have a bit of a problem getting my guests to reboot after the OS installation using virt-install.

For whatever reason, virt-install insists on inserting "--no-reboot" when you create a VM:

LC_ALL=C PATH=/sbin:/usr/sbin:/bin:/usr/bin QEMU_AUDIO_DRV=none /usr/libexec/qemu-kvm -S -M rhel6.2.0 -enable-kvm -m 512 -smp 1,sockets=1,cores=1,threads=1 -name centos62test -uuid f4938758-98f1-cda3-5ec9-d91d6cc40596 -nodefconfig -nodefaults
 -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/centos62test.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-reboot* -no-shutdown -kernel /var/lib/libvirt/boot/virtinst-vmlinuz.HzY2RZ -initrd

Even though you did not specify --no-reboot:

 virt-install --name centos62test --disk path=/home/vms/centos62test,size=50,bus=virtio --vnc --noautoconsole --vcpus=1 --ram=512 --network bridge=virbr0,mac=52:54:00:75:80:12 --location=http://192.168.15.100/mirrors/centos/6.2/os/x86_64/ -x "ks=http://192.168.15.100/mirrors/ks/6.2/kvm/x86_64.cfg"

It seems to be unique a virt-install "problem" because when you create a VM using virt-manager, --no-reboot option does not get inserted.

LC_ALL=C PATH=/sbin:/usr/sbin:/bin:/usr/bin QEMU_AUDIO_DRV=none /usr/libexec/qemu-kvm -S -M rhel6.2.0 -enable-kvm -m 512 -smp 1,sockets=1,cores=1,threads=1 -name centos62test -uuid f4938758-98f1-cda3-5ec9-d91d6cc40596 -nodefconfig -nodefaults
 -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/centos62test.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -drive file=/home/vms/centos62test,if=none,id=drive-virtio-disk0,format=

And it seems to occur on both CentOS 6.2 (which is the output I put up above this) and Ubuntu 10.04:

LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin QEMU_AUDIO_DRV=none /usr/bin/kvm -S -M pc-0.12 -enable-kvm -m 512 -smp 1 -name opensuseks -uuid 05ed4424-08ba-e724-a14f-50b76017609c -chardev socket,id=monitor,path=/v
ar/lib/libvirt/qemu/opensuseks.monitor,server,nowait -monitor chardev:monitor -no-reboot -boot c -kernel /var/lib/libvirt/boot/virtinst-linux.SZsBVy

I am at a bit of a loss here. How do I get virt-install to not add --no-reboot, so that my guests can reboot after the initial OS installation.

virtualization kvm-virtualization centos6 virt-install ubuntu-10.04
Martin Hope
Rilindo
Asked: 2011-11-27 13:52:46 +0800 CST
  • 3

What I am trying to do is to have my openBSD client (OpenBSD 4.9) auto mount a Linux NFS file system (Scientific Linux 6.1). So far, I am not sure if it is configured correctly.

To get things out of the way, I am able to mount nfs manually:

# mount_nfs -T -3 192.168.15.100:/exports /mnt
# ls -la /mnt
total 52
drwxr-xr-x   7 root    wheel   4096 Oct  4 22:42 .
drwxr-xr-x  16 root    wheel    512 Nov 26 16:33 ..
drwxrwxr-x   5 _sndio  _sndio  4096 Oct 31 21:58 centos
drwxr-xr-x  15 root    wheel   4096 Nov  6 09:17 home
drwxr-xr-x   5 root    wheel   4096 Oct 31 21:27 sl
drwxr-xr-x   3 root    wheel   4096 Nov 19 16:02 sles
drwxr-xr-x  17 503     503     4096 Nov 10 17:37 users
#

So connectivity is not an issue, as far as I can tell.

As per man page, the following is configured in /etc/amd/auto.home:

/defaults type:=nfs;sublink:=${key};opts:=rw,soft,intr,vers=3,proto=tcp
*         rhost:=192.168.15.100;rfs:=/exports

In turn, /etc/amd/master is configured as such:

# cat /etc/amd/master                                                                                                                                                                    
/exports amd.home

Upon reboot, I can it see mount, but curiously enough, instead of the hostname:

amd:24490                        0         0         0   100%    /exports

From what I understand, amd acts a little different from FreeBSD. Still, I tried to see if I it can automount.

Nope:

ksh: cd: /exports/users - Resource temporarily unavailable
# cd /exports/192.168.15.100/host/users
ksh: cd: /exports/192.168.15.100/host/users - Resource temporarily unavailable

A search in google doesn't help too much - it seems that automounting NFS with OpenBSD is not something that is usually done. Other than this, information is fairly sparse.

I can, of course, always mount is permanently, but I tend to be a bit anal on convention, so no for now. :)

Some direction would be appreciation.

(And oh, in case you are a wondering, I tried FreeBSD way of using amd and that hasn't worked out - although I wouldn't mind an explanation of the difference between how FreeBSD implements and how OpenBSD implements it)

UPDATE: After re-writing the map file several times, I got as far as actually communicating with the NFS server with this configuration:

/defaults type:=nfs;rhost:=kerberos.monzell.com;rfs:=/exports;\
          sublink:=${key};opts:=rw,nodev,nosuid,soft,intr,tcp,resvport
*         ${host}==${rhost};type:=nfs;fs:=${rfs};opts:=rw,nodev,nosuid,soft,intr,tcp,resvport

However, for some reason, it seems that amd will only default to NFS version 2 over udp:

# tcpdump dst kerberos
tcpdump: listening on pcn0, link-type EN10MB
tcpdump: WARNING: compensating for unaligned libpcap packets
20:38:28.558385 openbsd.monzell.com.856 > kerberos.monzell.com.sunrpc: udp 100
20:38:28.559154 openbsd.monzell.com.856 > kerberos.monzell.com.892: udp 96
20:38:30.592761 openbsd.monzell.com.856 > kerberos.monzell.com.nfsd: xid 0x22000000 (NFSv2) 40 null
20:38:33.558107 arp reply openbsd.monzell.com is-at 52:54:00:52:8f:66

I tried various options of forcing it to try to mount as nfsv3 such as:

/defaults type:=nfs;rhost:=kerberos.monzell.com;rfs:=/exports;\
          sublink:=${key};opts:=rw,nodev,nosuid,soft,intr,vers=3,proto=tcp,resvport
*         ${host}==${rhost};type:=nfs;fs:=${rfs};opts:=rw,nodev,nosuid,soft,intr,vers=3,proto=tcp,resvport

or:

/defaults type:=nfs;rhost:=kerberos.monzell.com;rfs:=/exports;\
          sublink:=${key};opts:=rw,nodev,nosuid,soft,intr,vers=-3,proto=tcp,resvport
*         ${host}==${rhost};type:=nfs;fs:=${rfs};opts:=rw,nodev,nosuid,soft,intr,vers=3,proto=tcp,resvport

Nothing yet still.

Curious enough, OpenBSD mounts defaults to version 3, so I am not sure why it would start with version 3 in amd. What would be the correct options to pass to automount?

EDIT: As I pointed out, I can point via fstab. For proof, here it is:

kerberos:/exports /mnt nfs rw,nodev,nosuid,tcp,soft,intr 1 1 
Filesystem        512-blocks      Used     Avail Capacity  Mounted on
/dev/wd0a             290396     89032    186848    32%    /
/dev/wd0k            3240316   1858940   1219364    60%    /home
/dev/wd0d             448956        12    426500     0%    /tmp
/dev/wd0f            1943196    903596    942444    49%    /usr
/dev/wd0g            1105820    346852    703680    33%    /usr/X11R6
/dev/wd0h            4387772    256560   3911824     6%    /usr/local
/dev/wd0j            2137436         4   2030564     0%    /usr/obj
/dev/wd0i            2137436         4   2030564     0%    /usr/src
/dev/wd0e             498940     18676    455320     4%    /var
amd:26660                  0         0         0   100%    /net
kerberos:/exports  103212280  66319088  31650312    68%    /mnt

As I noted, OpenBSD mounts via version 3 first, so I don't know why under amd, it would not mount via version 3 (tcp) and instead mount via version 2 with udp.

EDIT: As suggested, I attempted the following configurations:

defaults type:=nfs;fs:=${autodir}
  # autodir = -a parameter of amd call = amd_mnt in rc.conf = /tmp_mnt
  # Be careful with 'umount' and 'unmount' in the following.
remote type:=program;fs:=/mnt;\
        mount:="/sbin/mount_nfs kerberos.monzell.com:/exports/";\
        unmount:="/sbin/umount /mnt"

That returned

# cd /net/remote                                                                                                                                                                                 
usage:  [-23bcdilsTU] [-a maxreadahead] [-g maxgroups]
        [-I readdirsize] [-o options] [-R retrycnt] [-r readsize]
        [-t timeout] [-w writesize] [-x retrans] rhost:path node
ksh: cd: /net/remote - Operation not permitted

Then this:

defaults type:=nfs;fs:=${autodir}
  # autodir = -a parameter of amd call = amd_mnt in rc.conf = /tmp_mnt
  # Be careful with 'umount' and 'unmount' in the following.
remote type:=program;fs:=/mnt;\
        mount:="/sbin/mount nfs kerberos.monzell.com:/exports/";\
        unmount:="/sbin/umount /mnt"

Which returned this:

# cd /net/remote                                                                                                                                                                                 
nfs: realpath kerberos.monzell.com:/exports/: No such file or directory
ksh: cd: /net/remote - Operation not permitted

Nothing yet.

nfs openbsd automount
Martin Hope
Rilindo
Asked: 2011-10-23 17:56:29 +0800 CST
  • 4

For some reason, I can't su to root with from a non-root user:

[rilindo@kerberos ~]$ /bin/su -
-bash: /bin/su: Permission denied

Running output from /var/log/audit/audit.log either returns this:

[root@kerberos tmp]# cat /tmp/audit
type=AVC msg=audit(1319322088.937:68012): avc:  denied  { execute } for  pid=9794 comm="bash" name="su" dev=dm-0 ino=1048659 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1319322088.937:68012): arch=c000003e syscall=59 success=no exit=-13 a0=26a7df0 a1=26c9b30 a2=269efa0 a3=18 items=0 ppid=8435 pid=9794 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=4454 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)
type=AVC msg=audit(1319322088.944:68013): avc:  denied  { getattr } for  pid=9794 comm="bash" path="/bin/su" dev=dm-0 ino=1048659 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1319322088.944:68013): arch=c000003e syscall=4 success=no exit=-13 a0=26a7df0 a1=7fff26b200d0 a2=7fff26b200d0 a3=18 items=0 ppid=8435 pid=9794 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=4454 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)
type=AVC msg=audit(1319322088.944:68014): avc:  denied  { getattr } for  pid=9794 comm="bash" path="/bin/su" dev=dm-0 ino=1048659 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1319322088.944:68014): arch=c000003e syscall=4 success=no exit=-13 a0=26a7df0 a1=7fff26b200b0 a2=7fff26b200b0 a3=18 items=0 ppid=8435 pid=9794 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=4454 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)

Which leads to this solution from audit2allow:

[root@kerberos tmp]# cat /tmp/audit | audit2allow

#============= user_t ==============
#!!!! This avc is allowed in the current policy

allow user_t su_exec_t:file { execute getattr };
[root@kerberos tmp]#

Or this output:

type=AVC msg=audit(1319334064.195:39047): avc:  denied  { read open } for  pid=6067 comm="bash" name="su" dev=dm-0 ino=1048587 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1319334064.195:39047): arch=c000003e syscall=59 success=no exit=-13 a0=eecbd0 a1=eecbf0 a2=ec7720 a3=18 items=0 ppid=2857 pid=6067 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts8 ses=2 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)
type=AVC msg=audit(1319334064.200:39048): avc:  denied  { read } for  pid=6067 comm="bash" name="su" dev=dm-0 ino=1048587 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1319334064.200:39048): arch=c000003e syscall=21 success=no exit=-13 a0=eecbd0 a1=4 a2=0 a3=18 items=0 ppid=2857 pid=6067 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts8 ses=2 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)
type=AVC msg=audit(1319334064.200:39049): avc:  denied  { read } for  pid=6067 comm="bash" name="su" dev=dm-0 ino=1048587 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1319334064.200:39049): arch=c000003e syscall=2 success=no exit=-13 a0=eecbd0 a1=0 a2=43 a3=18 items=0 ppid=2857 pid=6067 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts8 ses=2 comm="bash" exe="/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)
type=AVC msg=audit(1319334064.208:39050): avc:  denied  { rlimitinh } for  pid=6069 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process
type=AVC msg=audit(1319334064.208:39050): avc:  denied  { siginh } for  pid=6069 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process
type=AVC msg=audit(1319334064.208:39050): avc:  denied  { noatsecure } for  pid=6069 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process
type=SYSCALL msg=audit(1319334064.208:39050): arch=c000003e syscall=59 success=yes exit=0 a0=944aa0 a1=9447e0 a2=943010 a3=1 items=0 ppid=6068 pid=6069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1319334064.369:39051): avc:  denied  { write } for  pid=6069 comm="setroubleshootd" name="rpm" dev=dm-0 ino=655363 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
type=SYSCALL msg=audit(1319334064.369:39051): arch=c000003e syscall=21 success=no exit=-13 a0=1405430 a1=2 a2=0 a3=9 items=0 ppid=6068 pid=6069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1319334064.370:39052): avc:  denied  { write } for  pid=6069 comm="setroubleshootd" name="rpm" dev=dm-0 ino=655363 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
type=SYSCALL msg=audit(1319334064.370:39052): arch=c000003e syscall=21 success=no exit=-13 a0=1405430 a1=2 a2=0 a3=5 items=0 ppid=6068 pid=6069 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)

At which, audit2allow suggests the following:

#============= setroubleshootd_t ==============
#!!!! The source type 'setroubleshootd_t' can write to a 'dir' of the following types:
# var_log_t, setroubleshoot_var_lib_t, setroubleshoot_var_run_t, setroubleshoot_var_log_t, var_lib_t, var_run_t, root_t

allow setroubleshootd_t rpm_var_lib_t:dir write;

#============= system_dbusd_t ==============
allow system_dbusd_t setroubleshootd_t:process { siginh rlimitinh noatsecure };

#============= user_t ==============
allow user_t su_exec_t:file { read open };

Curiously enough, it switch between the two messages whenever I tried to load new policy, as follows:

[root@kerberos tmp]# cat /tmp/audit2 | audit2allow -M local
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i local.pp

Attempting to use the upgrade option returns the following:

[root@kerberos tmp]# semodule -u local.pp 
libsemanage.get_direct_upgrade_filename: Previous module local is same or newer. (No such file or directory).
semodule:  Failed on local.pp!

Of note is the following:

  • The system originally didn't have selinux enabled. The problem started after I enabled selinux:

  • originally, it was a problem using "sudo su -", which during the troubleshooting, lead to this issue.

  • New hosts that I built after this had selinux enabled by default - and they didn't have this problem, which mean something didn't get enabled right when I revert SELinux to "enforcing" for the original server.

Here are the permissions and facl for the su command:

[root@kerberos tmp]# getfacl /bin/su 
getfacl: Removing leading '/' from absolute path names
# file: bin/su
# owner: root
# group: root
# flags: s--
user::rwx
group::r-x
other::r-x

[root@kerberos tmp]# ls -laZ /bin/su 
-rwsr-xr-x. root root system_u:object_r:su_exec_t:s0   /bin/su
[root@kerberos tmp]#

  • curiously enough, at some point, I had to execute su with the exact path, even though it is in my path. Also curiously, if I login as root, then su as the regular user, I can then use the su command:

    [root@kerberos tmp]# su - rilindo
[rilindo@kerberos ~]$ su - 
Password: 
[root@kerberos ~]#

Some direction is appreciated.

linux security su selinux
Martin Hope
Rilindo
Asked: 2011-09-27 20:48:00 +0800 CST
  • 0

Thanks to your help , I am getting closer. Now at this point, I am getting the following message with logging in via ssh:

debug1: Unspecified GSS failure.  Minor code may provide more information
Wrong principal in request

From the client side, after I request a ticket, I can confirm that it is being generated at the KDC log

Sep 27 00:37:11 kerberos.monzell.com krb5kdc[6060](info): TGS_REQ (1 etypes {18}) 192.168.15.37: ISSUE: authtime 1317097291, etypes {rep=18 tkt=18 ses=18}, [email protected] for krbtgt/[email protected]

and from the klist:

foster@kvm0007 ~]$ klist -f
Ticket cache: FILE:/tmp/krb5cc_502
Default principal: [email protected]

Valid starting     Expires            Service principal
09/27/11 00:21:31  09/28/11 00:21:31  krbtgt/[email protected]
    renew until 09/27/11 00:21:31, Flags: FRI
09/27/11 00:21:56  09/28/11 00:21:31  host/[email protected]
    renew until 09/27/11 00:21:31, Flags: FRT
[foster@kvm0007 ~]$

I initiate with the following:

ssh -p222 -K -lfoster  kerberos.monzell.com -vvv

From the server side, I setup a debug here:

/usr/sbin/sshd -d -D -f sshd_config

Here is the full debug from the client side:

[foster@kvm0007 ~]$ ssh -p222 -K -lfoster  kerberos.monzell.com -vvv
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /home/users/foster/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to kerberos.monzell.com [192.168.15.100] port 222.
debug1: Connection established.
debug1: identity file /home/users/foster/.ssh/identity type -1
debug1: identity file /home/users/foster/.ssh/id_rsa type -1
debug3: Not a RSA1 key file /home/users/foster/.ssh/id_dsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/users/foster/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug3: Wrote 792 bytes for a total of 813
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug3: Wrote 24 bytes for a total of 837
debug2: dh_gen_key: priv key bits set: 136/256
debug2: bits set: 536/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: Wrote 144 bytes for a total of 981
debug3: put_host_port: [192.168.15.100]:222
debug3: put_host_port: [kerberos.monzell.com]:222
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug1: checking without port identifier
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 1
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 1
debug1: Host 'kerberos.monzell.com' is known and matches the RSA host key.
debug1: Found key in /home/users/foster/.ssh/known_hosts:1
debug1: found matching key w/out port
debug2: bits set: 519/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: Wrote 16 bytes for a total of 997
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug3: Wrote 48 bytes for a total of 1045
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/users/foster/.ssh/identity ((nil))
debug2: key: /home/users/foster/.ssh/id_rsa ((nil))
debug2: key: /home/users/foster/.ssh/id_dsa (0x7f23d128dd10)
debug3: Wrote 64 bytes for a total of 1109
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: Trying to reverse map address 192.168.15.100.
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 1205
debug1: Delegating credentials
debug3: Wrote 1392 bytes for a total of 2597
debug1: Delegating credentials
debug1: Unspecified GSS failure.  Minor code may provide more information
Generic error (see e-text)

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 2693
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 2789
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 2885
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/users/foster/.ssh/identity
debug3: no such identity: /home/users/foster/.ssh/identity
debug1: Trying private key: /home/users/foster/.ssh/id_rsa
debug3: no such identity: /home/users/foster/.ssh/id_rsa
debug1: Offering public key: /home/users/foster/.ssh/id_dsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 528 bytes for a total of 3413
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
[email protected]'s password:

And from the server side:

[root@kerberos ~]# /usr/sbin/sshd -d -D -f sshd_config
debug1: sshd version OpenSSH_5.3p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: rexec_argv[2]='-D'
debug1: rexec_argv[3]='-f'
debug1: rexec_argv[4]='sshd_config'
debug1: Bind to port 222 on 0.0.0.0.
Server listening on 0.0.0.0 port 222.
debug1: Bind to port 222 on ::.
Server listening on :: port 222.


debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 192.168.15.37 port 35193
debug1: Client protocol version 2.0; client software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: permanently_set_uid: 74/74
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user foster service ssh-connection method none
debug1: attempt 0 failures 0
debug1: PAM: initializing for "foster"
debug1: PAM: setting PAM_RHOST to "kvm0007.monzell.com"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 1 failures 0
Postponed gssapi-with-mic for foster from 192.168.15.37 port 35193 ssh2
debug1: Unspecified GSS failure.  Minor code may provide more information
Wrong principal in request

debug1: Got no client credentials
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 2 failures 1
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 3 failures 1
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 4 failures 1
debug1: userauth-request for user foster service ssh-connection method publickey
debug1: attempt 5 failures 1
debug1: test whether pkalg/pkblob are acceptable
debug1: temporarily_use_uid: 502/502 (e=0/0)
debug1: trying public key file /home/users/foster/.ssh/authorized_keys
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 502/502 (e=0/0)
debug1: trying public key file /home/users/foster/.ssh/authorized_keys2
debug1: restore_uid: 0/0
Failed publickey for foster from 192.168.15.37 port 35193 ssh2

List of principals:

[root@kerberos ~]# kadmin.local
Authenticating as principal rilindo/[email protected] with password.
kadmin.local:  listprincs
K/[email protected]
[email protected]
host/[email protected]
host/[email protected]
[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
krbtgt/[email protected]
[email protected]
rilindo/[email protected]
[email protected]

Here is the output from the key tab from the client:

[root@kvm0007 ~]# klist -k /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]

And the server:

[root@kerberos ~]# klist -k  /etc/krb5.keytab 
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]

And the krb5kdc.conf (both the same on the client the server).

[root@kvm0007 ~]# cat /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = MONZELL.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]

 MONZELL.COM = {
  kdc = kerberos.monzell.com
  admin_server = kerberos.monzell.com
  default_domain = monzell.com
 }

[domain_realm]
 .monzell.com = MONZELL.COM
 monzell.com = MONZELL.COM

For some reason, I want to say it is still some sort of hostname issue, but I can't say for certainty at this point.

EDIT: Output of getprinc:

root@kerberos ~]# kadmin -q "getprinc host/kerberos.monzell.com"
Authenticating as principal rilindo/[email protected] with password.
Password for rilindo/[email protected]: 
Principal: host/[email protected]
Expiration date: [never]
Last password change: Sun Sep 25 16:34:01 EDT 2011
Password expiration date: [none]
Maximum ticket life: 1 day 00:00:00
Maximum renewable life: 0 days 00:00:00
Last modified: Sun Sep 25 16:34:01 EDT 2011 (root/[email protected])
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 4
Key: vno 2, aes256-cts-hmac-sha1-96, no salt
Key: vno 2, aes128-cts-hmac-sha1-96, no salt
Key: vno 2, des3-cbc-sha1, no salt
Key: vno 2, arcfour-hmac, no salt
MKey: vno 1
Attributes:
Policy: hosts

Output from hostname command:

[root@kerberos ~]# hostname -f kerberos.monzell.com
kerberos.monzell.com
[root@kerberos ~]#
ssh single-sign-on mitkerberos scientific-linux
Martin Hope
Rilindo
Asked: 2011-09-26 18:37:43 +0800 CST
  • 2

SSO not working with OpenSSH - I have not been able to get GSSAPIAuthentication to work with Kerberos. Everytime I attempted to login, I kept getting prompted for the password.

During the troubleshooting, I initiated a debug here:

[foster@kvm0007 ~]$ kinit
Password for [email protected]: 
[foster@kvm0007 ~]$ ssh -p222 -K [email protected] -vvv
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /home/users/foster/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to kerberos.monzell.com [192.168.15.100] port 222.
debug1: Connection established.
debug1: identity file /home/users/foster/.ssh/identity type -1
debug1: identity file /home/users/foster/.ssh/id_rsa type -1
debug3: Not a RSA1 key file /home/users/foster/.ssh/id_dsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/users/foster/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug3: Wrote 792 bytes for a total of 813
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug3: Wrote 24 bytes for a total of 837
debug2: dh_gen_key: priv key bits set: 132/256
debug2: bits set: 499/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: Wrote 144 bytes for a total of 981
debug3: put_host_port: [192.168.15.100]:222
debug3: put_host_port: [kerberos.monzell.com]:222
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug1: checking without port identifier
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 1
debug3: check_host_in_hostfile: filename /home/users/foster/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 1
debug1: Host 'kerberos.monzell.com' is known and matches the RSA host key.
debug1: Found key in /home/users/foster/.ssh/known_hosts:1
debug1: found matching key w/out port
debug2: bits set: 505/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: Wrote 16 bytes for a total of 997
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug3: Wrote 48 bytes for a total of 1045
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/users/foster/.ssh/identity ((nil))
debug2: key: /home/users/foster/.ssh/id_rsa ((nil))
debug2: key: /home/users/foster/.ssh/id_dsa (0x7fed559e5d30)
debug3: Wrote 64 bytes for a total of 1109
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: Trying to reverse map address 192.168.15.100.
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 1205
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 1301
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 1397
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we sent a gssapi-with-mic packet, wait for reply
debug3: Wrote 96 bytes for a total of 1493
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/users/foster/.ssh/identity
debug3: no such identity: /home/users/foster/.ssh/identity
debug1: Trying private key: /home/users/foster/.ssh/id_rsa
debug3: no such identity: /home/users/foster/.ssh/id_rsa
debug1: Offering public key: /home/users/foster/.ssh/id_dsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 528 bytes for a total of 2021
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
[email protected]'s password:

As you can see, gssapi-with-mic is being sent, but no decreeable response.

As it turns out, it appears that this is was being sent to the KDC:

debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user foster service ssh-connection method none
debug1: attempt 0 failures 0
debug1: PAM: initializing for "foster"
debug1: PAM: setting PAM_RHOST to "192.168.15.37"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 1 failures 0
debug1: Unspecified GSS failure.  Minor code may provide more information
**No key table entry found for host/[email protected]**

debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 2 failures 0
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 3 failures 0
debug1: userauth-request for user foster service ssh-connection method gssapi-with-mic
debug1: attempt 4 failures 0
debug1: userauth-request for user foster service ssh-connection method publickey
debug1: attempt 5 failures 0
debug1: test whether pkalg/pkblob are acceptable
debug1: temporarily_use_uid: 502/502 (e=0/0)
debug1: trying public key file /home/users/foster/.ssh/authorized_keys
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 502/502 (e=0/0)
debug1: trying public key file /home/users/foster/.ssh/authorized_keys2
debug1: restore_uid: 0/0

Some research indicated it may be an issue with the host file, which I have as follows:

[foster@sl6 ~]$ cat /etc/hosts
127.0.0.1       localhost.localdomain   localhost
::1     sl6     localhost6.localdomain6 localhost6
192.168.15.100  kerberos.monzell.com kerberos
192.168.15.100 monzell.com
192.168.15.31   kvm0001.monzell.com     kvm0001

I attempted to try to set the hostname manual on the host, with no effect.

Here are the list of principals at the KDC:

[root@sl6 ~]# kadmin.local
Authenticating as principal rilindo/[email protected] with password.
kadmin.local:  listprincs
K/[email protected]
[email protected]
host/[email protected]
host/[email protected]
[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
krbtgt/[email protected]
[email protected]
rilindo/[email protected]
[email protected]

Kerberos does most of the authentication. The user directory resides in OpenLDAP. Both the client and server are running Scientific Linux 6.1, with the client running as a VM on top of the server.

I can confirm that Kerberos works outside of OpenSSH, as indicated here:

[foster@kvm0007 ~]$ /usr/kerberos/bin/krsh -x -PN kerberos.monzell.com
This rlogin session is encrypting all data transmissions.
Last login: Sun Sep 25 21:18:20 from 192.168.15.37

The user(s) in question have the following ssh config file:

[foster@sl6 ~]$ cat .ssh/config 
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
GSSAPITrustDns yes

What direction should I go from this point?

EDIT: I knew I forgot to add something to this post. Here is the krb5.conf on the server:

[root@sl6 ~]# cat /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = MONZELL.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 MONZELL.COM = {
  kdc = kerberos.monzell.com
  admin_server = kerberos.monzell.com
 }

[domain_realm]
 .monzell.com = MONZELL.COM
 monzell.com = MONZELL.COM

And on the client:

[rilindo@kvm0007 ~]$ cat /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = MONZELL.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 EXAMPLE.COM = {
  kdc = kerberos.example.com
  admin_server = kerberos.example.com
 }

 MONZELL.COM = {
  kdc = kerberos.monzell.com
  admin_server = kerberos.monzell.com
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM
 monzell.com = MONZELL.COM
 .monzell.com = MONZELL.COM
ssh kerberos single-sign-on gssapi scientific-linux
Martin Hope
Rilindo
Asked: 2011-09-13 19:32:24 +0800 CST
  • 1

I have a small problem of getting my client to authenticate to a kerberos server that I just setup. Whenever I run:

[root@localhost log]# kadmin -r KERBEROS.MONZELL.COM -p host/kerberos.monzell.com
Authenticating as principal host/kerberos.monzell.com with password.

I get the following message:

Password for host/[email protected]: 
kadmin: Communication failure with server while initializing kadmin interface

On the server side, I see the following:

Sep 12 23:19:47 sl6 krb5kdc[6349](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.15.31: SERVER_NOT_FOUND: host/[email protected] for kadmin/[email protected], Server not found in Kerberos database

Although it seems to be doing else afterwards:

Sep 12 23:19:47 sl6 krb5kdc[6349](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.15.31: ISSUE: authtime 1315883987, etypes {rep=18 tkt=18 ses=18}, host/[email protected] for kadmin/[email protected]
Sep 12 23:24:14 sl6 krb5kdc[6349](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.15.31: ISSUE: authtime 1315884254, etypes {rep=18 tkt=18 ses=18}, host/[email protected] for kadmin/[email protected]

I tried to a few principals to get it working:

kadmin.local:  listprincs
K/[email protected]
host/[email protected]
host/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
[email protected]
krbtgt/[email protected]
[email protected]
root/[email protected]

As well as adding the hostnames for the real and client on both the client's hosts file as well as the server hosts file (client is kvm0001.monzell.com, while the kerberos server is kerberos.monzell.com). So far, no success.

What direction should I go from here?

Both client and server are running Scientific Linux 6, BTW, the client being a KVM instance running on top of the server.

Let me add that yes, there is an option to enable Kerberos Authentication within the authconfig utility. However, it is my first time setting up a Kerberos server, so I don't know if it would actually work. Which is why I am going through this particular exercise.

linux authentication kerberos mitkerberos
Martin Hope
Rilindo
Asked: 2011-08-20 18:54:55 +0800 CST
  • 2

This problem is similar to this, except that in this case, it is not working. :(

So far, I have this set as the ACL:

access to attrs=userPassword,shadowLastChange,shadowMin,shadowMax,shadowWarning,loginShell,shadowLastChange
    by anonymous auth
    by self write
    by users read 
    by * none

access to *
    by self write
    by users read
    by * none

I am able to change the password as the root:

[root@sl6 openldap]# ldappasswd -D 'cn=root,dc=monzell,dc=com' -W -S 'uid=monzell,ou=People,dc=monzell,dc=com'
New password: 
Re-enter new password: 
Enter LDAP Password: 
[root@sl6 openldap]#

But not as the user:

[root@sl6 openldap]# ldappasswd -D 'uid=monzell,ou=People,dc=monzell,dc=com' -W -S 'uid=monzell,ou=People,dc=monzell,dc=com'
New password: 
Re-enter new password: 
Enter LDAP Password: 
Result: Insufficient access (50)

Here is my schema of the user, BTW:

# monzell, People, monzell.com
dn: uid=monzell,ou=People,dc=monzell,dc=com
uid: monzell
cn: monzell
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowLastChange: 15192
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 501
gidNumber: 501
homeDirectory: /home/users/monzell
userPassword:: (REDACTED)

As well as my base DN:

dn: dc=monzell,dc=com
dc: monzell
objectClass: top
objectClass: domain

dn: ou=People,dc=monzell,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit

dn: ou=Group,dc=monzell,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit

I am running scientific linux 6.1, with OpenLDAP 2.4.23-15.

(Incidentally, the setup is based on the page here)

The log output from ldappasswd returns the following:

Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 fd=24 ACCEPT from IP=127.0.0.1:50252 (IP=0.0.0.0:389)
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=0 BIND dn="uid=monzell,ou=People,dc=monzell,dc=com" method=128
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=0 BIND dn="uid=monzell,ou=People,dc=monzell,dc=com" mech=SIMPLE ssf=0
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=0 RESULT tag=97 err=0 text=
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=1 PASSMOD id="uid=monzell,ou=People,dc=monzell,dc=com" new
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=1 RESULT oid= err=50 text=
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 op=2 UNBIND
Aug 20 08:45:18 sl6 slapd[4634]: conn=1019 fd=24 closed

Here is the conf file:

include     /etc/openldap/schema/corba.schema
include     /etc/openldap/schema/core.schema
include     /etc/openldap/schema/cosine.schema
include     /etc/openldap/schema/duaconf.schema
include     /etc/openldap/schema/dyngroup.schema
include     /etc/openldap/schema/inetorgperson.schema
include     /etc/openldap/schema/java.schema
include     /etc/openldap/schema/misc.schema
include     /etc/openldap/schema/nis.schema
include     /etc/openldap/schema/openldap.schema
include     /etc/openldap/schema/ppolicy.schema
include     /etc/openldap/schema/collective.schema
pidfile     /var/run/openldap/slapd.pid
argsfile    /var/run/openldap/slapd.args
TLSCACertificateFile /etc/openldap/cacerts/cacert.pem
TLSCertificateFile /etc/openldap/ssl/cert.crt
TLSCertificateKeyFile /etc/openldap/ssl/private.key
database    bdb
suffix "dc=monzell,dc=com"
checkpoint  1024 15
rootdn "cn=root,dc=monzell,dc=com"
rootpw <REDACTED
directory   /var/lib/ldap
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
database monitor
access to attrs=userPassword 
 by self write
 by users read 
 by * none
access to *
 by self write
 by users read
 by * none

EDIT: Now this is interesting. When I set the log level to 128, I get this in the log file:

Aug 20 12:27:54 sl6 slapd[2692]: /etc/openldap/slapd.conf: line 139: warning: cannot assess the validity of the ACL scope within backend naming context
Aug 20 12:27:54 sl6 slapd[2692]: /etc/openldap/slapd.conf: line 144: warning: cannot assess the validity of the ACL scope within backend naming context
Aug 20 12:27:54 sl6 slapd[2693]: config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context
Aug 20 12:27:54 sl6 slapd[2693]: slapd starting

EDIT: And when I attempted to reset the password, I see this:

Aug 20 12:32:47 sl6 slapd[2868]: => access_allowed: result not in cache (userPassword)
Aug 20 12:32:47 sl6 slapd[2868]: => access_allowed: auth access to "uid=monzell,ou=People,dc=monzell,dc=com" "userPassword" requested
Aug 20 12:32:47 sl6 slapd[2868]: => slap_access_allowed: backend default auth access granted to "(anonymous)"
Aug 20 12:32:47 sl6 slapd[2868]: => access_allowed: auth access granted by read(=rscxd)
Aug 20 12:32:47 sl6 slapd[2868]: => access_allowed: backend default write access denied to "uid=monzell,ou=People,dc=monzell,dc=com"
ldap openldap
Martin Hope
Rilindo
Asked: 2011-06-27 06:56:18 +0800 CST
  • 5

I am building out a kickstart network that resides on a different VLAN uses its own DHCP server. For some reason, my kickstart clients kept getting assign IPs from my primary DHCP server.

The way I have it set up is that I have a primary DHCP server on this router here:

192.168.15.1

Connected to that DHCP server is a switch with the IP of 192.168.15.2. My kickstart (Scientific Linux) server is connected to that switch on two ports:

Port 2 - where the kickstart server communicates to the rest of the production network via eth0. The IP assigned to the server on that interface is 192.168.15.100 (on eth0). The details are:

Interface: eth0
IP: 192.168.15.100
Netmask: 255.255.255.0
Gateway: 192.168.15.1

Port 7 - has it's own VLAN ID (along with port 8). The kickstart server is connected to that port with the IP of 172.16.15.100 (on eth1). Again, the details are:

Interface: eth1
IP: 172.16.15.100
Netmask: 255.255.255.0
Gateway: none

The kickstart server runs its own DHCP server and assigns them over the eth1. Most of the kick starts are built over the kickstart VLAN through port 8. To prevent the kickstart DHCP server from assigning addresses over the production network, I have the route setup like so:

route add -host 255.255.255.255 dev eth1

At this point, the clients kept getting assign IPs from the 192.168.15.1 DHCP server. I need to figure out a way to block client requests from reaching that DHCP. Its should be noted that but I also build KVM hosts on the kickstart server as well, so I need those KVMs to have the ability to get DHCP requests from the 192.168.15.1 DHCP server via the bridge network once I finish resolved this particular problem. (Currently, they communicate via NAT).

So what would be done to resolve this? Through iptables or some sort of routing I need to put in?

I tried to limited to requests via IPtables on that interface, allowing DHCP requests for 172.16.15.x network:

-A INPUT -i eth1 -s 172.16.15.0/24 -p udp -m udp --dport 69 -j ACCEPT
-A INPUT -i eth1 -s 172.16.15.0/24 -p tcp -m tcp --dport 69 -j ACCEPT
-A INPUT -i eth1 -s 172.16.15.0/24 -p udp -m udp --dport 68 -j ACCEPT
-A INPUT -i eth1 -s 172.16.15.0/24 -p tcp -m tcp --dport 68 -j ACCEPT
-A INPUT -i eth1 -s 172.16.15.0/24 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i eth1 -s 172.16.15.0/24 -p tcp -m tcp --dport 67 -j ACCEPT

And rejects assignments on eth1 from 192.168.15.x network:

-A FORWARD -o eth1 -s 192.168.15.0/24 -p udp -m udp --dport 69 -j REJECT
-A FORWARD -o eth1 -s 192.168.15.0/24 -p tcp -m tcp --dport 69 -j REJECT
-A FORWARD -o eth1 -s 192.168.15.0/24 -p udp -m udp --dport 68 -j REJECT
-A FORWARD -o eth1 -s 192.168.15.0/24 -p tcp -m tcp --dport 68 -j REJECT
-A FORWARD -o eth1 -s 192.168.15.0/24 -p udp -m udp --dport 67 -j REJECT
-A FORWARD -o eth1 -s 192.168.15.0/24 -p tcp -m tcp --dport 67 -j REJECT

Nope. :(

linux dhcp iptables