Home » Mailing lists » Devel » Re: PROBLEM: LXC Container, CIFS and Kerberos isolation issue
| Re: PROBLEM: LXC Container, CIFS and Kerberos isolation issue [message #42031] |
Thu, 03 February 2011 17:44  |
Rob Landley
Messages: 19
Registered: December 2010
|
Junior Member |
|
|
cc:ing the containers list for tracking purposes...
On 02/03/2011 07:56 AM, Nicolas Bourbaki wrote:
> Hi,
>
> I've got a problem with LXC, CIFS and Kerberos. Sorry if you're not
> the person concerned by this but I've seen you submited a patch about
> LXC and CIFS mounts recently
>
>
> Here is my bug report :
>
>
> ------------------------------------------------------------ ------------------------------------------------------------ -----
> [1.] Summary
> Kerberos credential are taken from the host context when using
> mount.cifs in an lxc container
Yeah, not surprised there's more to do there. I only had one very
simple test case, and I stopped when I made that work.
I'm happy to fix it, the question is how do I set up a kerberos
authentication test case? (I'm not very experienced at setting up
samba, I'm more a developer than a sysadmin.) A quick rummage found:
https://help.ubuntu.com/community/Samba/Kerberos
Which presumably explains it. I'll go read that...
> [2.] Description
> When using kerberos as system authentication for CIFS, mount fails in
> an LXC container. We need to have the kerberos ticket ans keyutils in
> the host to have it works. So it seem's that there is an isolation
> problem for this particular configuration.
>
> [2.1] Scenario 1: Host is minimalist, container fully configured
> (kerberos, CIFS, credentials, ...)
> #mount.cifs '//some-server/some-directory' /mnt -o
> iocharset=utf8,rw,sec=krb5i,user=foo
> mount error(2): No such file or directory
>
> [2.2] Scenario 2: Host has keyutils package (ubuntu) installed but no
> credentials, container fully configured (kerberos, CIFS, credentials,
> ...)
> #mount.cifs '//some-server/some-directory' /mnt -o
> iocharset=utf8,rw,sec=krb5i,user=foo
> mount error(126): Required key not available
>
> [2.3] Scenario 3: Host has keyutils package (ubuntu) installed and
> kerberos credentials, container fully configured (kerberos, CIFS,
> credentials, ...)
> #mount.cifs '//some-server/some-directory' /mnt -o
> iocharset=utf8,rw,sec=krb5i,user=foo
> Succes !
Should be fairly straightforward to fix, I just need to set up the test
case...
> -----------------
> lxc version: 0.7.2
> -----------------
> ii krb5-config 2.2
> Configuration files for Kerberos Version 5
> ii libgssapi-krb5-2 1.8.1+dfsg-5ubuntu0.2
> MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
> ii libkrb5-26-heimdal 1.4.0~git20100605.dfsg.1-2
> Heimdal Kerberos - libraries
> ii libkrb5-3 1.8.1+dfsg-5ubuntu0.2
> MIT Kerberos runtime libraries
> ii libkrb5support0 1.8.1+dfsg-5ubuntu0.2
> MIT Kerberos runtime libraries - Support library
> ii cifs-utils 2:4.5-2
> Common Internet File System utilities
Ok.
Thanks,
Rob
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containe rs
|
|
|
|
|
|
| Re: PROBLEM: LXC Container, CIFS and Kerberos isolation issue [message #42036 is a reply to message #42034] |
Fri, 04 February 2011 20:36  |
Rob Landley
Messages: 19
Registered: December 2010
|
Junior Member |
|
|
On 02/04/2011 02:37 AM, Nicolas Bourbaki wrote:
> 2011/2/3 Rob Landley <rlandley@parallels.com>:
>> cc:ing the containers list for tracking purposes...
>>
>
> I've created an entry in the kernel.org' bugzilla #28122 (I forget
> that this may have been the proper way to do it). Seem's it more
> global than I first thank.
It's nice for tracking purposes, but if you'd put a bug report in there
and hadn't cc'd me, I'd never have seen it.
>> https://help.ubuntu.com/community/Samba/Kerberos
>>
>> Which presumably explains it. I'll go read that...
>
> If you have any question in setting it, I may try to help, giving you
> some of our configuration.
Well, it's not quite trivial to set up:
https://help.ubuntu.com/community/Kerberos
> All servers that are part of a Kerberos authentication realm should
> be assigned a Fully Qualified Domain Name (FQDN) that is both
> forward- and reverse-resolvable.
But apparently I can fake that with /etc/hosts...
I note that installing "krb5-kdc krb5-admin-server" installed bind 9, an
SGML library, and a geoip database. And failed to download 11 packages
until I ran "aptitude update" on the lenny test environment.
Setting up krb5-kdc (1.8.3+dfsg-4) ...
krb5kdc: cannot initialize realm KVM - see log file for details
Setting up krb5-admin-server (1.8.3+dfsg-4) ...
kadmind: No such file or directory while initializing, aborting
Yeah, this is probably going to take a while...
Rob
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containe rs
|
|
|
|
Goto Forum:
Current Time: Sat Aug 02 13:53:08 GMT 2025
Total time taken to generate the page: 0.40159 seconds
|
OpenVZ Forum
Members
Search
Help
Register
Login
Home
