From: Alexander Bokovoy <ab@altlinux.org> To: ALT Linux Team development discussions <devel@lists.altlinux.org> Subject: Re: [devel] Новый Kerberos и новая Samba Date: Wed, 22 Nov 2017 18:50:13 +0200 Message-ID: <CAG0OwAEgfo_ZSou0-QSJ4uvi0M+wvh0S6XLXPkHEt4Wd_UKWew@mail.gmail.com> (raw) In-Reply-To: <CAK42-GqBy3_xtE=PUJtBhKb5nj-ccwjdK7Yp8rQeJJFdMx8JaA@mail.gmail.com> 2017-11-22 16:04 GMT+02:00 Evgeny Sinelnikov <sin@altlinux.org>: > Здравсвуйте, > > В эти выходные в сизиф отправился новый libkrb5. Новая Samba (пока > 4.6.11, готовится 4.7.3) тоже уехала в сизиф и p8. > > В krb5.conf опция includedir для /etc/krb5.conf.d/ теперь включена, по > умолчанию. > > При этом проявилась регрессия, которая имелась и раньше. При включении > includedir проблема проявляется вне зависимости от версии libkrb5. В > p8 на libkrb5-1.14.5 проблема воспроизводится точно также, как и в > сизифе на libkrb5-1.15.2 и для samba-DC-4.6.x выглядит следующим > образом: > > ==> server.domain.alt: + samba-tool domain provision > --realm=DOMAIN.ALT --domain DOMAIN '--adminpass=Pa$$word' > --dns-backend=SAMBA_INTERNAL --server-role=dc --use-rfc2307 > --host-ip=192.168.56.2 > ==> server.domain.alt: Looking up IPv6 addresses > ==> server.domain.alt: Setting up share.ldb > ==> server.domain.alt: Setting up secrets.ldb > ==> server.domain.alt: Setting up the registry > ==> server.domain.alt: Setting up the privileges database > ==> server.domain.alt: Setting up idmap db > ==> server.domain.alt: Setting up SAM db > ==> server.domain.alt: Setting up sam.ldb partitions and settings > ==> server.domain.alt: Setting up sam.ldb rootDSE > ==> server.domain.alt: Pre-loading the Samba 4 and AD schema > ==> server.domain.alt: Adding DomainDN: DC=domain,DC=alt > ==> server.domain.alt: Adding configuration container > ==> server.domain.alt: Setting up sam.ldb schema > ==> server.domain.alt: Setting up sam.ldb configuration data > ==> server.domain.alt: Setting up display specifiers > ==> server.domain.alt: Modifying display specifiers > ==> server.domain.alt: Adding users container > ==> server.domain.alt: Modifying users container > ==> server.domain.alt: Adding computers container > ==> server.domain.alt: Modifying computers container > ==> server.domain.alt: Setting up sam.ldb data > ==> server.domain.alt: Setting up well known security principals > ==> server.domain.alt: Setting up sam.ldb users and groups > ==> server.domain.alt: ERROR(ldb): uncaught exception - operations > error at ../source4/dsdb/samdb/ldb_modules/password_hash.c:2820 > ==> server.domain.alt: File > "/usr/lib64/python2.7/site-packages/samba/netcmd/__init__.py", line > 176, in _run > ==> server.domain.alt: return self.run(*args, **kwargs) > ==> server.domain.alt: File > "/usr/lib64/python2.7/site-packages/samba/netcmd/domain.py", line 471, > in run > ==> server.domain.alt: nosync=ldap_backend_nosync, > ldap_dryrun_mode=ldap_dryrun_mode) > ==> server.domain.alt: File > "/usr/lib64/python2.7/site-packages/samba/provision/__init__.py", line > 2175, in provision > ==> server.domain.alt: skip_sysvolacl=skip_sysvolacl) > ==> server.domain.alt: File > "/usr/lib64/python2.7/site-packages/samba/provision/__init__.py", line > 1787, in provision_fill > ==> server.domain.alt: next_rid=next_rid, dc_rid=dc_rid) > ==> server.domain.alt: File > "/usr/lib64/python2.7/site-packages/samba/provision/__init__.py", line > 1447, in fill_samdb > ==> server.domain.alt: "KRBTGTPASS_B64": > b64encode(krbtgtpass.encode('utf-16-le')) > ==> server.domain.alt: File > "/usr/lib64/python2.7/site-packages/samba/provision/common.py", line > 55, in setup_add_ldif > ==> server.domain.alt: ldb.add_ldif(data, controls) > ==> server.domain.alt: File > "/usr/lib64/python2.7/site-packages/samba/__init__.py", line 225, in > add_ldif > ==> server.domain.alt: self.add(msg, controls) > > > Мы уже с этим сталкивались: > - Не работает создание домена SambaDC > https://bugzilla.altlinux.org/show_bug.cgi?id=33409 > > И не мы одни, но при нашем участии: > - [Samba] samba 4.6.0 dc provisioning fails with exception > https://lists.samba.org/archive/samba/2017-March/207031.html > - Uncaught exception at ldb_modules/password_hash.c:2241 during new > domain provision > https://bugzilla.samba.org/show_bug.cgi?id=11573 > > В последней баге (Samba #11573) Andrew Bartlett, в итоге, ответил: >> We need to backport: >> https://github.com/heimdal/heimdal/commit/fe43be85587f834266623adb0ecf2793d212a7ca Проще говоря, heimdal до какой-то версии не умел include/includedir. > В целом, "это не бага, а фича". Так сложилось. Причём для samba-4.7, > которая собрана в новой федоре это уже и не актуально. Новая Samba > поддерживает MIT Kerberos, а не только Нeimdal. Думаю, что можно добавить этот патч в Самбу 4.6.3 в сборке. И избавиться от него при переезде на MIT. -- / Alexander Bokovoy
next prev parent reply other threads:[~2017-11-22 16:50 UTC|newest] Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-11-22 14:04 Evgeny Sinelnikov 2017-11-22 16:50 ` Alexander Bokovoy [this message] 2017-11-22 23:46 ` Evgeny Sinelnikov 2017-11-23 11:38 ` Evgeny Sinelnikov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CAG0OwAEgfo_ZSou0-QSJ4uvi0M+wvh0S6XLXPkHEt4Wd_UKWew@mail.gmail.com \ --to=ab@altlinux.org \ --cc=devel@lists.altlinux.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
ALT Linux Team development discussions This inbox may be cloned and mirrored by anyone: git clone --mirror http://lore.altlinux.org/devel/0 devel/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 devel devel/ http://lore.altlinux.org/devel \ devel@altlinux.org devel@altlinux.ru devel@lists.altlinux.org devel@lists.altlinux.ru devel@linux.iplabs.ru mandrake-russian@linuxteam.iplabs.ru sisyphus@linuxteam.iplabs.ru public-inbox-index devel Example config snippet for mirrors. Newsgroup available over NNTP: nntp://lore.altlinux.org/org.altlinux.lists.devel AGPL code for this site: git clone https://public-inbox.org/public-inbox.git