Uploaded image for project: 'FreeNAS / TrueNAS'
  1. FreeNAS / TrueNAS
  2. NAS-103046

Fix Kerberos keytab string handling

    XMLWordPrintable

    Details

      Description

      Assuming a configuration where FreeNfiAS is configured to use AD, using an imported keytab file, where the NetBIOS style SPN is used. (see attached image)

      The NetBIOS style hostname usually includes a '$' sign at the end.

      I.E nd-bsd-1$@REALM

       

      observed behaviour:

      Upon (re)start of the AD Directory Service on FreeNAS, cachetool passes the SPN 'nd-bsd-1REALM' string to kinit, which inevitably fails. (Mind the missing '$@' signs)

      This produces the following log messages:

      Sep  6 03:30:21 nd-bsd-1 /cachetool.py: [common.pipesubr:65] Popen()ing: /usr/bin/kinit --renewable -k -t /etc/kerberos/nd-bsd-1 ND-BSD-1LAN.DOMAIN.AT
      Sep  6 03:30:25 nd-bsd-1 /cachetool.py: [common.pipesubr:65] Popen()ing: /usr/bin/kinit --renewable -k -t /etc/kerberos/nd-bsd-1 ND-BSD-1LAN.DOMAIN.AT
      Sep  6 10:34:16 nd-bsd-1 uwsgi: [common.pipesubr:65] Popen()ing: /usr/bin/kinit --renewable -k -t /etc/kerberos/nd-bsd-1 ND-BSD-1LAN.DOMAIN.AT
      

      Whereas the kerberos_start script properly calls

      Sep  6 10:34:47 nd-bsd-1 ActiveDirectory: kerberos_start: /usr/bin/kinit --renewable -t /etc/kerberos/nd-bsd-1 -k ND-BSD-1$@LAN.DOMAIN.AT
      

      This is most likely, due to improper escaping of the SPN string passed on to kinit, causing '$' to be interpreted as a special character.

       

      expected behaviour:

      The string passed on to kinit by cachetool.py (?) is being properly escaped.

        Attachments

        1. AD_config.png
          AD_config.png
          32 kB
        2. Kerberos principal config.png
          Kerberos principal config.png
          47 kB
        3. system.py
          16 kB

          Attachments

            JEditor

              Issue Links

                Activity

                  People

                  Assignee:
                  awalker Andrew Walker
                  Reporter:
                  kleinem Emanuel Klein
                  Votes:
                  0 Vote for this issue
                  Watchers:
                  3 Start watching this issue

                    Dates

                    Created:
                    Updated:
                    Resolved: