RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 817824 - Internal Server Error if /tmp directory and credential ccache have incorrect permissions
Summary: Internal Server Error if /tmp directory and credential ccache have incorrect ...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: mod_auth_kerb
Version: 6.3
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Luboš Uhliarik
QA Contact: BaseOS QE - Apps
URL: http://krbdev.mit.edu/rt/Ticket/Displ...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-05-01 13:28 UTC by Jenny Severance
Modified: 2021-01-14 09:34 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-10-17 07:37:52 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Jenny Severance 2012-05-01 13:28:56 UTC 
Description of problem:

# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin

Valid starting     Expires            Service principal
05/01/12 09:21:32  05/02/12 09:21:31  krbtgt/TESTRELM.COM
05/01/12 09:21:34  05/02/12 09:21:31  HTTP/dhcp-186-52.testrelm.com

# ls -al /tmp/krb5cc_0 
-rw-------. 1 root root 1229 May  1 09:21 /tmp/krb5cc_0


# ipa user-find
ipa: ERROR: cannot connect to u'http://dhcp-186-52.testrelm.com/ipa/xml': Internal Server Error


/var/log/httpd/error_log
[Tue May 01 09:22:07 2012] [error] [client 10.16.186.52] gss_acquire_cred() failed: Unspecified GSS failure.  Minor code may provide more information (, ), referer: https://dhcp-186-52.testrelm.com/ipa/xml



Version-Release number of selected component (if applicable):
ipa-server-2.2.0-11.el6.i686

How reproducible:


Steps to Reproduce:
1. delete /tmp/
2. mkdir -p /tmp/
3. chmod 1777 /tmp/
4. kinit admin
5. ipa user-find
  
Actual results:
ipa: ERROR: cannot connect to u'http://dhcp-186-52.testrelm.com/ipa/xml': Internal Server Error

Expected results:
Error specifying what the problem is.

Additional info:
Comment 1 Rob Crittenden 2012-05-01 13:39:10 UTC 
Were there any AVCs related to this?

Can you provide more context in the error log? Perhaps retry it with LogLevel set to debug in /etc/httpd/conf.d/nss.conf (restart httpd required)?

The Internal Server Error is designed to be generic and provide as little information as possible. It is expected that the user will report this to an administrator who will investigate further.

This should most likely be re-assigned to krb5 which is generating the unspecified GSS failure. Perhaps it can better report on permission problems.
Comment 2 Jenny Severance 2012-05-01 14:26:27 UTC 
Yup ::

# cat /var/log/audit/audit.log | grep AVC
type=AVC msg=audit(1335882337.598:41120): avc:  denied  { write } for  pid=1594 comm="httpd" name="tmp" dev=dm-0 ino=521231 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=dir
Comment 3 Dmitri Pal 2012-05-01 15:42:18 UTC 
Moving to krb5. Please open an upstream bug.
The bug should talk about making Kerberos error messages more informative.
Comment 4 Rob Crittenden 2012-05-01 21:38:41 UTC 
Created krbdev.mit.edu issue #7123
Comment 5 RHEL Program Management 2012-05-05 04:14:53 UTC 
Since RHEL 6.3 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.
Comment 6 Robbie Harwood 2015-09-09 22:07:44 UTC 
Upstream thinks this is a problem with the capture of error messages, not with krb5 itself; they believe that more information is available though IPA (through mod_auth_kerb) is not printing it.
Comment 8 Red Hat Bugzilla Rules Engine 2017-10-17 07:37:52 UTC 
Development Management has reviewed and declined this request. You may appeal this decision by reopening this request.
Note You need to log in before you can comment on or make changes to this bug.