[Bug 1037055] Re: winbind does not refresh kerberos tickets

[styro]

I'm also hit by what seems to be the same bug on 12.04. This happens on
both desktops and servers using winbind (pam_winbind) to manage kerberos
keytabs and ticket caches.

We are authenticating against an Active Directory domain controller (2008R2).
We use the winbind/kerberos combo for:
* logging into Ubuntu desktops,
* transparent SSH access (via GSSAPI) to other Ubuntu/Debian machines,
* single sign on for webapps running on both Linux and Windows servers,
* and authenticating access to file shares (both Samba and Windows)

We often find our kerberos credential caches disappearing. This stops
kerberos authentication working for eg SSH, HTTP(S), CIFS etc. Things
work very well otherwise.

Impact:
* If it happens on the client, the client can't authenticate to any kerberised servers (Windows or Linux).
* If it happens on the server, all clients (Windows or Linux) are unable to connect to that server any more.
* The main impact is very flaky network authentication on an LTS release that we will have to live with for a few more years.

Workaround:
On the desktop run kinit to create a new ticket cache, or on a server restart the winbind daemon after logging in with a local account. This usually needs to be done once or twice a week on my desktop, but less frequently on servers.

Test case:
I don't have a good understanding on how to reliably reproduce it apart from waiting several days for it to stop authenticating. But the earlier posters above seem to have a better handle on that part.


I will commit to testing any proposed updates.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to samba in Ubuntu.
https://bugs.launchpad.net/bugs/1037055

Title:
  winbind does not refresh kerberos tickets

Status in Samba:
  Fix Released
Status in “samba” package in Ubuntu:
  Confirmed

Bug description:
  winbindd will renew kerberos tickets until they expire, but it seems
  unable to refresh them before expiry.

  I have the following in smb.conf:

  winbind refresh ticket = true

  and have cached_login set for pam_winbind

  After 7 days ( the renewal limit on AD kerberos tickets) the ticket
  expires and I lose access to my NFS home directory which uses sec=krb5

  I have tried to debug why this is happening and have come to the
  conclusion that there are two important variables for ticket
  refreshing to work (both in winbind/winbindd_cred_cache.c):

  ccache_list
  memory_creds_list

  and that the function that stores the password for later refreshing
  use is called

  winbindd_add_memory_creds

  This function though requires that the user is in ccache_list before
  it stores the password in a way it can be used by the rekinit part of
  the function krb5_ticket_refresh_handler.

  The problem as I see it is that winbind forks and the parent populates ccache_list and the child populates memory_creds_list.
  This leads to the password not being stored in a way that can be used by the rekinit code in krb5_ticket_refresh_handler.

  As a dirty hack (attached) I tried populating memory_creds_list from
  the same location as ccache_list get populated
  (winbindd_raw_kerberos_login in winbind/winbindd_pam.c).

  This hack "fixes" the problem.

  ProblemType: Bug
  DistroRelease: Ubuntu 12.04
  Package: winbind 2:3.6.3-2ubuntu2.3
  ProcVersionSignature: Ubuntu 3.2.0-27.43-generic 3.2.21
  Uname: Linux 3.2.0-27-generic x86_64
  ApportVersion: 2.0.1-0ubuntu12
  Architecture: amd64
  Date: Wed Aug 15 11:30:27 2012
  InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Release amd64 (20120425)
  ProcEnviron:
   LANGUAGE=en_GB:en
   TERM=xterm
   PATH=(custom, no user)
   LANG=en_GB.UTF-8
   SHELL=/bin/bash
  SambaClientRegression: No
  SourcePackage: samba
  UpgradeStatus: No upgrade log present (probably fresh install)
  mtime.conffile..etc.default.winbind: 2012-07-06T14:00:57
  mtime.conffile..etc.init.d.winbind: 2012-07-06T14:00:57

To manage notifications about this bug go to:
https://bugs.launchpad.net/samba/+bug/1037055/+subscriptions