6:05 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Bug ID: 2212343
Summary: kinit: Connection refused while getting default ccache
(broken sssd)
Product: Fedora
Version: 38
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Severity: medium
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: thofman(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
jhrozek(a)redhat.com, lslebodn(a)redhat.com,
luk.claes(a)gmail.com, mzidek(a)redhat.com,
pbrezina(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Hello, on freshly installed system, after installing krb5-workstation and
configuring /etc/krb5.conf, I'm unable to use `kinit` command:
```
$ kinit thofman(a)REDHAT.COM
kinit: Connection refused while getting default ccache
```
Complete output of `KRB5_TRACE=/dev/stderr strace -f klist` is attached bellow.
Notably, strace shows lines like:
```
connect(4, {sa_family=AF_UNIX, sun_path="/var/run/.heim_org.h5l.kcm-socket"},
110) = -1 ECONNREFUSED (Connection refused)
```
Not sure if this is related, but sssd is installed (was in base installation?)
but does not start:
```
$ systemctl status sssd
○ sssd.service - System Security Services Daemon
Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; preset:
ena>
Drop-In: /usr/lib/systemd/system/service.d
└─10-timeout-abort.conf
Active: inactive (dead)
Condition: start condition failed at Mon 2023-06-05 10:03:58 CEST; 43min ago
├─ ConditionPathExists=|/etc/sssd/sssd.conf was not met
└─ ConditionDirectoryNotEmpty=|/etc/sssd/conf.d was not met
Jun 05 10:03:58 fedora systemd[1]: sssd.service - System Security Services
Daem>
```
When I modify /etc/krb5.conf.d/kcm_default_ccache and comment out the line
"default_ccache_name = KCM:", kinit starts to work.
Reproducible: Always
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
6:06 a.m.
New subject: [Bug 2212343] kinit: Connection refused while getting default ccache (broken sssd)
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
--- Comment #1 from Tomas Hofman <thofman(a)redhat.com> ---
Created attachment 1969037
--> https://bugzilla.redhat.com/attachment.cgi?id=1969037&action=edit
strace if the kinit command
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
6:07 a.m.
New subject: [Bug 2212343] kinit: Connection refused while getting default ccache
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Tomas Hofman <thofman(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|kinit: Connection refused |kinit: Connection refused
|while getting default |while getting default
|ccache (broken sssd) |ccache
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
6:16 a.m.
New subject: [Bug 2212343] kinit: Connection refused while getting default ccache
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Alexander Bokovoy <abokovoy(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(thofman(a)redhat.co
| |m)
--- Comment #2 from Alexander Bokovoy <abokovoy(a)redhat.com> ---
Do you have sssd-kcm installed?
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
8:46 a.m.
New subject: [Bug 2212343] kinit: Connection refused while getting default ccache
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Tomas Hofman <thofman(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(thofman(a)redhat.co |
|m) |
--- Comment #3 from Tomas Hofman <thofman(a)redhat.com> ---
Hello Alexander, yes, sssd-kcm is installed too.
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
10:03 a.m.
New subject: [Bug 2212343] kinit: Connection refused while getting default ccache
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Simo Sorce <ssorce(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(thofman(a)redhat.co
| |m)
--- Comment #4 from Simo Sorce <ssorce(a)redhat.com> ---
What do you get if you run this as root:
# systemctl status sssd-kcm.socket
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
2:30 a.m.
New subject: [Bug 2212343] kinit: Connection refused while getting default ccache
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Tomas Hofman <thofman(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(thofman(a)redhat.co |
|m) |
--- Comment #5 from Tomas Hofman <thofman(a)redhat.com> ---
It shows:
```
$ sudo systemctl status sssd-kcm.socket
× sssd-kcm.socket - SSSD Kerberos Cache Manager responder socket
Loaded: loaded (/usr/lib/systemd/system/sssd-kcm.socket; enabled; preset:
enabled)
Active: failed (Result: service-start-limit-hit) since Mon 2023-06-05
10:04:14 CEST; 23h ago
Duration: 15.767s
Triggers: ● sssd-kcm.service
Docs: man:sssd-kcm(8)
Listen: /run/.heim_org.h5l.kcm-socket (Stream)
Jun 05 10:03:58 fedora systemd[1]: Listening on sssd-kcm.socket - SSSD Kerberos
Cache Manager responder socket.
Jun 05 10:04:14 fedora systemd[1]: sssd-kcm.socket: Failed with result
'service-start-limit-hit'.
```
I tried to restart it but it ends up in the same state. `journalctl -u
sssd-kcm.service` shows:
```
Jun 06 09:18:34 fedora systemd[1]: Starting sssd-kcm.service - SSSD Kerberos
Cache Manager...
Jun 06 09:18:34 fedora systemd[1]: Started sssd-kcm.service - SSSD Kerberos
Cache Manager.
Jun 06 09:18:34 fedora sssd_kcm[41417]: Starting up
Jun 06 09:18:34 fedora sssd_kcm[41417]: Failed to init Kerberos context
[Permission denied]
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Main process exited,
code=exited, status=3/NOTIMPLEMENTED
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Failed with result
'exit-code'.
Jun 06 09:18:34 fedora systemd[1]: Starting sssd-kcm.service - SSSD Kerberos
Cache Manager...
Jun 06 09:18:34 fedora systemd[1]: Started sssd-kcm.service - SSSD Kerberos
Cache Manager.
Jun 06 09:18:34 fedora sssd_kcm[41422]: Starting up
Jun 06 09:18:34 fedora sssd_kcm[41422]: Failed to init Kerberos context
[Permission denied]
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Main process exited,
code=exited, status=3/NOTIMPLEMENTED
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Failed with result
'exit-code'.
Jun 06 09:18:34 fedora systemd[1]: Starting sssd-kcm.service - SSSD Kerberos
Cache Manager...
Jun 06 09:18:34 fedora systemd[1]: Started sssd-kcm.service - SSSD Kerberos
Cache Manager.
Jun 06 09:18:34 fedora sssd_kcm[41425]: Starting up
Jun 06 09:18:34 fedora sssd_kcm[41425]: Failed to init Kerberos context
[Permission denied]
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Main process exited,
code=exited, status=3/NOTIMPLEMENTED
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Failed with result
'exit-code'.
Jun 06 09:18:34 fedora systemd[1]: Starting sssd-kcm.service - SSSD Kerberos
Cache Manager...
Jun 06 09:18:34 fedora systemd[1]: Started sssd-kcm.service - SSSD Kerberos
Cache Manager.
Jun 06 09:18:34 fedora sssd_kcm[41428]: Starting up
Jun 06 09:18:34 fedora sssd_kcm[41428]: Failed to init Kerberos context
[Permission denied]
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Main process exited,
code=exited, status=3/NOTIMPLEMENTED
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Failed with result
'exit-code'.
Jun 06 09:18:34 fedora systemd[1]: Starting sssd-kcm.service - SSSD Kerberos
Cache Manager...
Jun 06 09:18:34 fedora systemd[1]: Started sssd-kcm.service - SSSD Kerberos
Cache Manager.
Jun 06 09:18:34 fedora sssd_kcm[41431]: Starting up
Jun 06 09:18:34 fedora sssd_kcm[41431]: Failed to init Kerberos context
[Permission denied]
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Main process exited,
code=exited, status=3/NOTIMPLEMENTED
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Failed with result
'exit-code'.
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Start request repeated too
quickly.
Jun 06 09:18:34 fedora systemd[1]: sssd-kcm.service: Failed with result
'exit-code'.
Jun 06 09:18:34 fedora systemd[1]: Failed to start sssd-kcm.service - SSSD
Kerberos Cache Manager.
```
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...
4:35 a.m.
New subject: [Bug 2212343] kinit: Connection refused while getting default ccache
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
--- Comment #6 from Alexander Bokovoy <abokovoy(a)redhat.com> ---
Jun 06 09:18:34 fedora sssd_kcm[41417]: Failed to init Kerberos context
[Permission denied]
this sounds like you have some of krb5.conf-included files inaccessible. This
is a known issue with krb5 library -- if when reading /etc/krb5.conf and
includes it cannot read some file, the whole initialization of the library is
failing.
So check that /etc/krb5.conf and includes are globally readable. We had some
customers who had files in /etc/krb5.conf.d or in
/var/lib/sss/pubconf/krb5.conf.d that had been unreadable to any non-root
process.
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...
7:13 a.m.
New subject: [Bug 2212343] kinit: Connection refused while getting default ccache
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
--- Comment #7 from Lukas Slebodnik <lslebodn(a)redhat.com> ---
this sounds like you have some of krb5.conf-included files
inaccessible.
Or more likely wrong SELinux file context for /etc/krb5.conf :-)
e.g.
[root@localhost ~]# ls -lZ /etc/krb5.conf
-rw-r--r--. 1 root root system_u:object_r:user_home_t:s0 880 Nov 16 2022
/etc/krb5.conf
[root@localhost ~]# systemctl status sssd-kcm
× sssd-kcm.service - SSSD Kerberos Cache Manager
Loaded: loaded (/usr/lib/systemd/system/sssd-kcm.service; indirect; vendor
preset: disabled)
Active: failed (Result: exit-code) since Tue 2023-06-06 14:11:20 CEST;
1min 23s ago
TriggeredBy: ● sssd-kcm.socket
Docs: man:sssd-kcm(5)
Process: 697372 ExecStartPre=/usr/sbin/sssd --genconf-section=kcm
(code=exited, status=0/SUCCESS)
Process: 697373 ExecStart=/usr/libexec/sssd/sssd_kcm --uid 0 --gid 0
${DEBUG_LOGGER} (code=exited, status=3)
Main PID: 697373 (code=exited, status=3)
Jun 06 14:11:20 localhost.localdomain systemd[1]: Starting SSSD Kerberos Cache
Manager...
Jun 06 14:11:20 localhost.localdomain systemd[1]: Started SSSD Kerberos Cache
Manager.
Jun 06 14:11:20 localhost.localdomain sssd_kcm[697373]: Starting up
Jun 06 14:11:20 localhost.localdomain sssd_kcm[697373]: Failed to init Kerberos
context [Permission denied]
Jun 06 14:11:20 localhost.localdomain systemd[1]: sssd-kcm.service: Main
process exited, code=exited, status=3/NOTIMPLEMENTED
Jun 06 14:11:20 localhost.localdomain systemd[1]: sssd-kcm.service: Failed with
result 'exit-code'.
[root@localhost ~]# ausearch -m avc -ts recent
----
time->Tue Jun 6 14:11:20 2023
type=AVC msg=audit(1686053480.757:10014): avc: denied { read } for
pid=697373 comm="sssd_kcm" name="krb5.conf" dev="dm-2"
ino=6676617
scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:user_home_t:s0
tclass=file permissive=0
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...
9:22 a.m.
New subject: [Bug 2212343] kinit: Connection refused while getting default ccache
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Tomas Hofman <thofman(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |NOTABUG
Last Closed| |2023-06-06 14:22:14
--- Comment #8 from Tomas Hofman <thofman(a)redhat.com> ---
Yes! It was wrong selinux context:
$ ls -lZ /etc/krb5.conf*
-rw-r--r--. 1 root root unconfined_u:object_r:user_home_t:s0 1006 Jun 6 16:14
/etc/krb5.conf
After correcting to
-rw-r--r--. 1 root root unconfined_u:object_r:krb5_conf_t:s0 1006 Jun 6 16:15
/etc/krb5.conf
and restarting sssd-kcm.service and sssd-kcm.socket it works.
Thanks for all the help!
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2212343
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...
337
days inactive
338
days old
sssd-maintainers@lists.fedoraproject.org
9 comments
1 participants
participants (1)
-
bugzilla＠redhat.com