Bug 1087068 – 0006526: GSS api stopped working properly after krb5 update

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1087068 - 0006526: GSS api stopped working properly after krb5 update

Summary:	0006526: GSS api stopped working properly after krb5 update

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	krb5 (Show other bugs)
Sub Component:
Version:	6.6
Hardware:	All Linux

Priority	unspecified Severity high
Target Milestone:	rc
Target Release:	---
Assigned To:	Nalin Dahyabhai
QA Contact:	Patrik Kis
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2014-04-13 16:06 EDT by vaclav
Modified:	2014-10-14 04:10 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:	krb5-1.10.3-23.el6
Doc Type:	Bug Fix
Doc Text:	Cause: Due to a regression, when using the GSSAPI SPNEGO mechanism, acceptor (server) applications which knew of multiple OIDs by which a given underlying mechanism could be selected would not always respond to initiators (clients) using the same mechanism OIDs which the initiator had specified. Consequence: GSSAPI clients attempting to authenticate to such servers could erroneously fail to authenticate. Fix: The GSSAPI library has been patched to once again use the OID used by the client in its request when generating replies to be sent to the client. Result: GSSAPI clients attempting to authenticate to such servers will no longer fail to authenticate due to this bug.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-10-14 04:10:51 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:1389	normal	SHIPPED_LIVE	Moderate: krb5 security and bug fix update	2014-10-13 21:27:10 EDT

Groups: None (edit)

Description vaclav 2014-04-13 16:06:47 EDT

Description of problem:

GSS-TSIG stopped working (it worked in the past) with MS Active Directory so Windows can not register/update DNS records. This bug is very sneaky - no log in the logfile, after debugging enabled: "failed gss_inquire_cred: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Success."

This could be GSSAPI library bug or bind bug (or both), because it works with ISC SPNEGO (after recompiling bind without "--disable-isc-spnego") but not with GSSAPI SPNEGO.

WORKAROUND: Downgrading of kerberos packages to krb5-devel-1.9-33.el6_3.3.i686.rpm krb5-libs-1.9-33.el6_3.3.i686.rpm krb5-workstation-1.9-33.el6_3.3.i686.rpm

This is an old bug, so downgrading of krb5 could cause some security issues.


How reproducible:

Every signed Active Directory dns update using gssapi.


Affected OS versions:

All versions of krb5 > 1.9-33.el6_3.3 in CentOS (see https://bugs.centos.org/view.php?id=6526). I am not using it in rhel, but it seems to be an rhel issue.

Comment 2 Tomáš Hozza 2014-04-14 02:36:03 EDT

Hi.

AFAIK this is not a bug in BIND's source. The "--disable-isc-spnego" is used
to NOT use ISC own SPNEGO implementation, but to rather use the GSSAPI
implementation. This has to be fixed in the krb5.

The fix should be this:
http://krbdev.mit.edu/rt/Ticket/Display.html?id=7858

I'm moving this to krb5 component and CC-ing Simo, as he initiated a discussion
about this recently.

Comment 3 Simo Sorce 2014-04-14 12:06:43 EDT

This bug has recently been fixed in Fedora, see:
https://bugzilla.redhat.com/show_bug.cgi?id=1066000

you may want to clone the bug for RHEL ?

Comment 4 vaclav 2014-04-14 23:36:05 EDT

This Fedora bug seems to be the same. Will be those fixed packages backported to the rhel?

Comment 5 Simo Sorce 2014-04-14 23:58:59 EDT

Nalin,
can we backport to RHEL 6.6 ?

Comment 6 Nalin Dahyabhai 2014-04-15 15:15:09 EDT

I think the patch could be added, yes.

Comment 7 Simo Sorce 2014-04-16 13:38:19 EDT

Can we get devel_ack then ?

Comment 11 errata-xmlrpc 2014-10-14 04:10:51 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2014-1389.html

Note You need to log in before you can comment on or make changes to this bug.