OpenVZ Forum


Home » Mailing lists » Devel » Re: PROBLEM: LXC Container, CIFS and Kerberos isolation issue
Re: PROBLEM: LXC Container, CIFS and Kerberos isolation issue [message #42031] Thu, 03 February 2011 17:44 Go to next message
Rob Landley is currently offline  Rob Landley
Messages: 19
Registered: December 2010
Junior Member
From: 64.134.149*
cc:ing the containers list for tracking purposes...

On 02/03/2011 07:56 AM, Nicolas Bourbaki wrote:
> Hi,
>
> I've got a problem with LXC, CIFS and Kerberos. Sorry if you're not
> the person concerned by this but I've seen you submited a patch about
> LXC and CIFS mounts recently
>
>
> Here is my bug report :
>
>
> ------------------------------------------------------------ ------------------------------------------------------------ -----
> [1.] Summary
> Kerberos credential are taken from the host context when using
> mount.cifs in an lxc container

Yeah, not surprised there's more to do there. I only had one very
simple test case, and I stopped when I made that work.

I'm happy to fix it, the question is how do I set up a kerberos
authentication test case? (I'm not very experienced at setting up
samba, I'm more a developer than a sysadmin.) A quick rummage found:

https://help.ubuntu.com/community/Samba/Kerberos

Which presumably explains it. I'll go read that...

> [2.] Description
> When using kerberos as system authentication for CIFS, mount fails in
> an LXC container. We need to have the kerberos ticket ans keyutils in
> the host to have it works. So it seem's that there is an isolation
> problem for this particular configuration.
>
> [2.1] Scenario 1: Host is minimalist, container fully configured
> (kerberos, CIFS, credentials, ...)
> #mount.cifs '//some-server/some-directory' /mnt -o
> iocharset=utf8,rw,sec=krb5i,user=foo
> mount error(2): No such file or directory
>
> [2.2] Scenario 2: Host has keyutils package (ubuntu) installed but no
> credentials, container fully configured (kerberos, CIFS, credentials,
> ...)
> #mount.cifs '//some-server/some-directory' /mnt -o
> iocharset=utf8,rw,sec=krb5i,user=foo
> mount error(126): Required key not available
>
> [2.3] Scenario 3: Host has keyutils package (ubuntu) installed and
> kerberos credentials, container fully configured (kerberos, CIFS,
> credentials, ...)
> #mount.cifs '//some-server/some-directory' /mnt -o
> iocharset=utf8,rw,sec=krb5i,user=foo
> Succes !

Should be fairly straightforward to fix, I just need to set up the test
case...

> -----------------
> lxc version: 0.7.2
> -----------------
> ii krb5-config 2.2
> Configuration files for Kerberos Version 5
> ii libgssapi-krb5-2 1.8.1+dfsg-5ubuntu0.2
> MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
> ii libkrb5-26-heimdal 1.4.0~git20100605.dfsg.1-2
> Heimdal Kerberos - libraries
> ii libkrb5-3 1.8.1+dfsg-5ubuntu0.2
> MIT Kerberos runtime libraries
> ii libkrb5support0 1.8.1+dfsg-5ubuntu0.2
> MIT Kerberos runtime libraries - Support library
> ii cifs-utils 2:4.5-2
> Common Internet File System utilities

Ok.

Thanks,

Rob
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containe rs
Re: PROBLEM: LXC Container, CIFS and Kerberos isolation issue [message #42034 is a reply to message #42031] Fri, 04 February 2011 08:37 Go to previous messageGo to next message
Nicolas Bourbaki is currently offline  Nicolas Bourbaki
Messages: 1
Registered: February 2011
Junior Member
From: *parallels.com
2011/2/3 Rob Landley <rlandley@parallels.com>:
> cc:ing the containers list for tracking purposes...
>

I've created an entry in the kernel.org' bugzilla #28122 (I forget
that this may have been the proper way to do it). Seem's it more
global than I first thank.

>> ------------------------------------------------------------ ------------------------------------------------------------ -----
>> [1.] Summary
>> Kerberos credential are taken from the host context when using
>> mount.cifs in an lxc container
>
> Yeah, not surprised there's more to do there.  I only had one very
> simple test case, and I stopped when I made that work.
>
> I'm happy to fix it, the question is how do I set up a kerberos
> authentication test case?  (I'm not very experienced at setting up
> samba, I'm more a developer than a sysadmin.)  A quick rummage found:
>
>  https://help.ubuntu.com/community/Samba/Kerberos
>
> Which presumably explains it.  I'll go read that...

If you have any question in setting it, I may try to help, giving you
some of our configuration.

Thanks

Nicolas
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containe rs
Re: PROBLEM: LXC Container, CIFS and Kerberos isolation issue [message #42036 is a reply to message #42034] Fri, 04 February 2011 20:36 Go to previous message
Rob Landley is currently offline  Rob Landley
Messages: 19
Registered: December 2010
Junior Member
From: *tmodns.net
On 02/04/2011 02:37 AM, Nicolas Bourbaki wrote:
> 2011/2/3 Rob Landley <rlandley@parallels.com>:
>> cc:ing the containers list for tracking purposes...
>>
>
> I've created an entry in the kernel.org' bugzilla #28122 (I forget
> that this may have been the proper way to do it). Seem's it more
> global than I first thank.

It's nice for tracking purposes, but if you'd put a bug report in there
and hadn't cc'd me, I'd never have seen it.

>> https://help.ubuntu.com/community/Samba/Kerberos
>>
>> Which presumably explains it. I'll go read that...
>
> If you have any question in setting it, I may try to help, giving you
> some of our configuration.

Well, it's not quite trivial to set up:

https://help.ubuntu.com/community/Kerberos

> All servers that are part of a Kerberos authentication realm should
> be assigned a Fully Qualified Domain Name (FQDN) that is both
> forward- and reverse-resolvable.

But apparently I can fake that with /etc/hosts...

I note that installing "krb5-kdc krb5-admin-server" installed bind 9, an
SGML library, and a geoip database. And failed to download 11 packages
until I ran "aptitude update" on the lenny test environment.

Setting up krb5-kdc (1.8.3+dfsg-4) ...
krb5kdc: cannot initialize realm KVM - see log file for details
Setting up krb5-admin-server (1.8.3+dfsg-4) ...
kadmind: No such file or directory while initializing, aborting

Yeah, this is probably going to take a while...

Rob
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containe rs
Previous Topic: Re: [PATCH, v3 2/2] cgroups: introduce timer slack subsystem
Next Topic: Re: [PATCH v7 1/3] cgroups: read-write lock CLONE_THREAD forking per threadgroup
Goto Forum:
  


Current Time: Sat Jul 21 11:29:27 GMT 2018