summaryrefslogtreecommitdiffstats
path: root/utils/gssd/krb5_util.c
Commit message (Collapse)AuthorAgeFilesLines
* gssd: By default, don't spam syslog when users' credentials expireKevin Coffman2009-01-051-3/+3
| | | | | | | | | | | | | | | | | | Change the priority of "common" log messages so that syslog doesn't get slammed/spammed when users' credentials expire, or there is another common problem which would cause error messages for all context creation requests. Note that this will now require that gssd or svcgssd option "-v" is used to debug these common cases. Original patch from Andrew Pollock <apollock@google.com>. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com> CC: Andrew Pollock <apollock@google.com>
* The rpc.gssd scans for any suitable kerberos ticket. In cross-realmLukas Hejtmanek2008-07-151-13/+147
| | | | | | | | | | environment this may not be the desired behaviour. Therefore a new option, -R preferred realm, is presented so that the rpc.gssd prefers tickets from this realm. By default, the default realm is preferred. Signed-off-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd_setup_krb5_user_gss_ccache must return an error if no usable cache isLukas Hejtmanek2008-07-151-4/+5
| | | | | | | | found. Trying to use invalid default cache and continue is not good idea at all. Signed-off-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Kerberos credentials may be stored in multiple places. Make itVince Busam2008-05-071-14/+16
| | | | | | | | | | possible to search several directories for valid credentials when making NFS requests. Original patch from Vince Busam <vbusam@google.com> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>. Signed-off-by: Steve Dickson <steved@redhat.com>
* Add the other two DES encryption types to the default list ofKevin Coffman2008-05-071-1/+3
| | | | | | | Kerberos encryption types that may be negotiated. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Stop gssd from ignoring the machine credential cacheVince Busam2008-02-261-1/+1
| | | | | | | defined by the -d flag Signed-off-by: Steve Dickson <steved@redhat.com> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>
* Always get addressless ticketsKevin Coffman2007-05-031-2/+32
| | | | | | | | Make sure we get addressless tickets so we can function behind a NAT. (Must use a different function to accomplish this with Heimdal.) Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Factor out error message printing differences between MIT and HeimdalKevin Coffman2007-04-201-18/+44
| | | | | | | | | | Use a common function that factors out differences between MIT and Heimdal in getting the right error message printed. Add an autoconf check to see if the newer error message function is available. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu>
* Remove the now unused functionsKevin Coffman2007-03-311-234/+0
| | | | | | | | Remove functions that are no longer used when when obtaining machine credentials. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Clean up gssd_get_single_krb5_cred and its debugging messagesKevin Coffman2007-03-311-8/+12
| | | | | | | Clean up gssd_get_single_krb5_cred and its debugging messages Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use newly added keytab functionsKevin Coffman2007-03-311-7/+8
| | | | | | | | | | | | | | | | | | | | | | | Use the new functions added in the previous patch. Obtain machine credentials in a pre-determined order Look for appropriate machine credentials in the following order: root/<fqdn>@REALM nfs/<fqdn>@REALM host/<fqdn>@REALM root/<any-name>@REALM nfs/<any-name>@REALM host/<any-name>@REALM The first matching credential will be used. Also, the machine credentials to be used are now determined "on-demand" rather than at gssd startup. This allows keytab additions to be noticed and used without requiring a restart of gssd. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Add new keytab handling functions for dealing with machine credentialsKevin Coffman2007-03-311-0/+466
| | | | | | | | | | | | | | | Add new functions that will be used in the next patch. The new behavior is to search for particular keytab entries in a specified order: root/<fqdn>@<REALM> nfs/<fqdn>@<REALM> host/<fqdn>@<REALM> root/<any-name>@<REALM> nfs/<any-name>@<REALM> host/<any-name>@<REALM> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Hide differences between MIT and Heimdal in macrosKevin Coffman2007-03-311-25/+5
| | | | | | | | | Clean up a lot of #ifdef'd code using macros, masking the differences between MIT and Heimdal implementations. The currently unused macros will be used in later patches. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Fix memory leak on error path of limit_krb5_enctypes()Kevin Coffman2007-03-311-0/+1
| | | | | | | Return credential on error path of limit_krb5_enctypes() Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Allow any credential to be used for machine credentialsKevin Coffman2007-03-191-16/+6
| | | | | | | | | | Don't restrict machine credentials to be "nfs/<machine.name>". Use any usable credentials contained in the keytab file. [We actually attempt to use the first entry found for each realm, not every entry, in the keytab.] Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Don't leak keytab entriesKevin Coffman2007-03-191-0/+5
| | | | | | | Free keytab entries while processing keytab file. Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Neil Brown <neilb@suse.de>
* Use lstat rather than stat in gssd_find_existing_krb5_ccacheNeil Brown2007-03-161-1/+1
| | | | | As this is a file in /tmp, a symlink could take us anywhere... If it was a NFS filesystem with a dead server, we could block for a long time..
* Use owner rather than filename format in choosing cred cache filesKevin Coffman2007-02-091-56/+50
| | | | | | | | | | | Signed-off-by: Glenn Machin <gmachin@sandia.gov> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Some installations use different name formats for their credentials caches. Instead of checking that the uid is part of the name, just make sure that uid is the owner of the file. This is a modification of the original patch from Glenn. Signed-off-by: Neil Brown <neilb@suse.de>
* Allow gssd ccaches in MEMORY: rather than FILE:Kevin Coffman2006-10-171-1/+7
| | | | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Add option to store gssd ccaches in a MEMORY: cache rather than the default FILE: cache. In response to suggestion from Steve Dickson <steved@redhat.com> and Nalin Dahyabhai <nalin@redhat.com>.
* Fix misc warning messagesKevin Coffman2006-10-171-0/+1
| | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Clean up a few warning messages.
* Limit acquire_cred call to to Kerberos onlykwc@citi.umich.edu2006-07-041-1/+6
| | | | | | | Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Specify that the acquire_cred call should only be concerned with returning Kerberos credentials since this is Kerberos-only functionality.
* Add option to specify directory to search for credentials cache filesneilbrown2006-03-281-6/+5
| | | | | | | | | From: Vince Busam <vbusam@google.com> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Add command line option to specify which directory should be searched to find credentials caches. (really this time)
* Updates from Kevin Coffman at UMichneilbrown2005-12-161-6/+4
|
* Add option to set rpcsec_gss debugging level (if available)neilbrown2005-08-261-4/+44
| | | | | | | Changes to allow gssd/svcgssd to build when using Hiemdal Kerberos libraries. Note that there are still run-time issues preventing this from working when shared libraries for libgssapi and librpcsecgss are used.
* 2005-08-26 Kevin Coffman <kwc@citi.umich.edu>neilbrown2005-08-261-39/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * utils/exportfs/exports.man: Document the "crossmnt" export export option * utils/gssd/krb5_util.c: Add better debugging and partially revert the function check for gss_krb5_ccache_name. For MIT Kerberos releases up to and including 1.3.1, we *must* use the routine gss_krb5_ccache_name to get the K5 gssapi code to use a different credentials cache. For releases 1.3.2 and on, we want to use the KRB5CCNAME environment variable to tell it what to use. (A problem was reported where 1.3.5 was being used, our code was using gss_krb5_ccache_name, but the underlying code continued to use the first (or default?) credentials cache. Switching to using the env variable fixed the problem. I cannot recreate this problem. *utils/gssd/krb5_util.c: Andrew Mahone <andrew.mahone@gmail.com> reported that reiser4 always has DT_UNKNOWN. He supplied patch to move the check for regular files after the stat() call to correctly find ccache files in reiser4 filesystem. Also change the name comparison so that the wrong file is not selected when the substring comparison is done. *utils/gssd/krb5_util.c: Limit the set of encryption types that can be negotiated by the Kerberos library to those that the kernel code currently supports. This should eventually query the kernel for the list of supported enctypes. *utils/gssd/gss_util.c, utils/svcgssd/svcgssd_main_loop.c: Print more information in error messages to help debugging failures. *utils/svcgssd/svcgssd_proc.c: Increase token buffer size and update error handling so that a response is always sent. *utils/svcgssd/svcgssd_proc.c: Add support to retrieve supplementary groups.
* Add gss support from citi @ umichneilbrown2004-10-191-0/+809
generated by cgit (git 2.34.1) at 2025-09-25 22:16:53 +0000