Auteur: Frank Richter Date: À: exim-users Sujet: Re: [exim] exim-4.92: GSSAPI authenticator doesn't work
Am 20.06.19 um 20:03 schrieb Viktor Dukhovni via Exim-users: > On Thu, Jun 20, 2019 at 04:05:52PM +0200, Frank Richter via Exim-users wrote:
>
>> 4.91:
>> …
>> 17651 Initialised Cyrus SASL server connection; service="smtp"
>> fqdn="servername.tu-chemnitz.de" realm="NULL"
> What user is exim 4.91 running as when reading the keytab file?
> And which keytab file has the keys for "smtp/servername.tu-chemnitz.de"?
> What are the permissions on that file?
exim runs as user exim, keytab is standard /etc/krb5.keytab
-r--r----- 1 cyrus exim 1514 21. Dez 2015 /etc/krb5.keytab
No changes between 4.91 and 4.92, both tried on the same host.
Now, we build exim-4.92 with 2 files from 4.91:
./src/auths/cyrus_sasl.h
./src/auths/cyrus_sasl.c
And … gssapi with cyrus-sasl works!
So there are some changes breaking at least our setup.
Unfortunately a quick look at the diffs doesn't unveil the relevant changes
to our eyes.
[…] > GSS acceptors don't communicate with the KDC, only GSS clients talk
> to the KDC, the servers just consume tokens supplied by clients and
> their own keytab file.
Ok, thanks.
Frank
--
Frank Richter
Chemnitz University of Technology, Germany