[OpenAFS] SuSE 9.2: anyone?

Sensei Sensei <senseiwa@tin.it>
Mon, 27 Dec 2004 17:10:49 +0100


Ken Aaker wrote:
> On the SuSE 9.2 systems (about 5) [...]

I've found the right kernel module, and now I'm facing some problems in 
making suse authenticate over out KDCs and use the afs namespace for 
home directories.

First, the AFS client seems to support only *one* ip address. I entered 
just one and ok, it seems that the cell is working anyway --- is it 
enough the CellSrvDB? I don't know anymore!

===[/etc/sysconfig/afs-client]===
THIS_CELL_SERVER="ip.address"
THIS_CELL_SERVER_NAME="cell.name"

Now, the problem is Kerberos5 and LDAP. We have MIT K5 along with 
OpenLDAP just for uid/gid and home dirs both on debian stable (we have 
other infos of course, but none of them are important from this point of 
view). LDAP has *NO* base dn. We have gentoo, debian, knoppix and redhat 
clients all working, but no luck with suse!

I can kinit and I gain the right token. The authentication from pam and 
nss_ldap are NOT working. Anyway, I don't see anything bad in my 
configuration:

===[/etc/openldap/ldap.conf]===
base
host    dir.cell.name slave.cell.name
nss_base_passwd
nss_base_shadow
nss_base_group

===[/etc/nsswitch.conf]===
passwd: files ldap
group:  files ldap
shadow: files ldap

hosts:  files dns
networks:       files dns

services:       db files
protocols:      db files
rpc:    db files
ethers: db files
netmasks:       files
netgroup:       files
publickey:      files

bootparams:     files
automount:      files
aliases:        files

===[/etc/pam.d/login]===
auth     requisite      pam_unix2.so            nullok #set_secrpc
auth     required       pam_krb5afs.so          use_first_pass nodelay
auth     required       pam_securetty.so
auth     required       pam_nologin.so
#auth    required       pam_homecheck.so
auth     required       pam_env.so
auth     required       pam_mail.so
account  required       pam_unix2.so
password required       pam_pwcheck.so          nullok
password required       pam_unix2.so            nullok use_first_pass
                                                 use_authtok
password required       pam_krb5afs.so
session  required       pam_unix2.so            none # debug or trace
session  required       pam_limits.so
session  required       pam_resmgr.so

===[/etc/sysconfig/ldap]===
BASE_CONFIG_DN=""
BIND_DN=""

===[/etc/krb5.conf]===
[libdefaults]
         clockskew = 300
         default_realm = CELL.NAME

[realms]
CELL.NAME = {
         kdc = krb.cell.name
         kdc = slave.cell.name
         default_domain = cell.name
         kpasswd_server = krb.cell.name
}

[domain_realm]
         .cell.name = CELL.NAME
         cell.name = CELL.NAME

[logging]
         default = SYSLOG:NOTICE:DAEMON
         kdc = FILE:/var/log/kdc.log
         kadmind = FILE:/var/log/kadmind.log

[appdefaults]
pam = {
         ticket_lifetime = 1d
         renew_lifetime = 1d
         forwardable = true
         proxiable = false
         retain_after_close = false
         minimum_uid = 0
         debug = false
         afs_cells = cell.name
}

I get this in /var/log/messages:

Dec 27 16:25:20 plm02 -- MARK --
Dec 27 16:41:43 plm02 login[15375]: pam_krb5afs: unable to determine
                                     uid/gid for user
Dec 27 16:41:43 plm02 login[15375]: pam_krb5afs: authentication fails
                                     for `username'
Dec 27 16:41:43 plm02 login[15375]: pam_krb5afs: pam_sm_authenticate
                                     returning 10 (User not known to the
                                     underlying authentication module)
Dec 27 16:41:50 plm02 login[15375]: FAILED LOGIN 1 FROM /dev/tty1 FOR
                                     UNKNOWN, User not known to the
                                     underlying authentication module
Dec 27 16:41:54 plm02 modprobe: FATAL: Could not load
                                 /lib/modules/2.6.8-24-default/
                                 modules.dep: No such file or directory

Anyway... I can use kerberos, afs but NOT ldap with nsswitch. LDAP is 
working CORRECTLY under GSSAPI!

plm02:/var/log # klist
klist: No ticket file: /tmp/krb5cc_0

plm02:/var/log # tokens

Tokens held by the Cache Manager:

    --End of list--

plm02:/var/log # kinit username
username@CELL.NAME's Password:
kinit: NOTICE: ticket renewable lifetime is 1 week

plm02:/var/log # klist
Credentials cache: FILE:/tmp/krb5cc_0
         Principal: username@CELL.NAME

   Issued           Expires          Principal
Dec 27 16:44:36  Dec 28 02:44:36  krbtgt/CELL.NAME@CELL.NAME
Dec 27 16:44:36  Dec 28 02:44:36  afs/cell.name@CELL.NAME
plm02:/var/log # tokens

Tokens held by the Cache Manager:

Tokens for afs@cell.name [Expires Dec 28 02:44]
    --End of list--


I can use AFS after all:


plm02:/var/log # cd /afs/cell.name/usr/u/username/private/
plm02:/afs/cell.name/usr/u/username/private/ # touch a
plm02:/afs/cell.name/usr/u/username/private/ # rm a

plm02:/afs/cell.name/usr/u/username/private/ # fs listacl .
Access list for . is
Normal rights:
   system:administrators rlidwka
   username rlidwka


But nsswitch isn't working!

plm02:/afs/cell.name/usr/u/username/private/ # groups username
id: username: No such user

plm02:/afs/cell.name/usr/u/username/private/ # ldapsearch "cn=plm"
SASL/GSSAPI authentication started
SASL username: username@CELL.NAME
SASL SSF: 56
SASL installing layers
# extended LDIF
#
# LDAPv3
# base <> with scope sub
# filter: cn=plm
# requesting: ALL
#

# plm
dn: cn=plm
objectClass: top
objectClass: posixGroup
cn: plm
gidNumber: 10002
memberUid: username
description: afs plm group

# search result
search: 5
result: 0 Success

# numResponses: 2
# numEntries: 1


You're using SuSE... so... what's going on here? :(

-- 
Sensei <mailto:senseiwa@tin.it> <pgp:8998A2DB>
        <icqnum:241572242>
        <yahoo!:sensei_sen>
        <msn-id:sensei_sen@hotmail.com>