topic Re: PAM Kerberos error message issue in Operating System - HP-UX

PAM Kerberos error message issue

Chui Kock You_1 — Wed, 09 May 2012 03:19:10 GMT

Hi,

New issue.

User wanted to setup the PAM Kerberos.

Package already installed.

root@uxkulh04> (/) $ swlist | grep -i ker

KRB5CLIENT E.1.6.2.09 Kerberos V5 Client Version 1.6.2.09

KerberosSvr D.03.20.02 Kerberos Server Version 3.2.2 and its Administration Utilities

PAMKerberos D.01.26 PAM-Kerberos Version 1.26

Once configured. And we try to initialize it. It give this error

root@uxkulh04> (/) $ kinit

/usr/lib/hpux32/dld.so: Unsatisfied code symbol 'krb5_cc_get_principal' in load module '/usr/bin/kinit'.

Killed

Appreciate some feedback from you.

Regards,

Chui

Re: PAM Kerberos error message issue

Dennis Handly — Wed, 09 May 2012 06:08:29 GMT

>dld.so: Unsatisfied code symbol 'krb5_cc_get_principal' in load module '/usr/bin/kinit'.

This symbol should be defined in /usr/lib/hpux32/libkrb5.so.1 which points to /opt/krb5core/lib/hpux32/.

Which is in KRB5-CLIENT.KRB5-IA321SLIB. For Version 1.3.5.03.

Re: PAM Kerberos error message issue

Chui Kock You_1 — Wed, 09 May 2012 07:55:59 GMT

Hi Dennis,

The softlink is already there and pointing to correct “/opt/krb5core/lib/hpux32/libkrb5.so.1”

root@uxkulh04> (/usr/lib/hpux32) $ pwd

/usr/lib/hpux32

root@uxkulh04> (/usr/lib/hpux32) $ ls -al libkrb5.so.1

lrwxr-xr-x 1 root sys 37 May 9 15:28 libkrb5.so.1 -> /opt/krb5core/lib/hpux32/libkrb5.so.1

root@uxkulh04> (/usr/lib/hpux32) $ kinit

/usr/lib/hpux32/dld.so: Unsatisfied code symbol 'krb5_cc_get_principal' in load module '/usr/bin/kinit'.

Killed

root@uxkulh04> (/usr/lib/hpux32) $

Regards,
Chui

Re: PAM Kerberos error message issue

Dennis Handly — Thu, 10 May 2012 04:24:32 GMT

>The softlink is already there and pointing to correct /opt/krb5core/lib/hpux32/libkrb5.so.1

It may be the correct file but not the correct content.

Or there is a mismatch between that file and kinit. (Or the bill of materials changed.)

Re: PAM Kerberos error message issue

Chui Kock You_1 — Thu, 10 May 2012 07:29:10 GMT

Hi Dennis,

Is there any solution.

Regards,
Chui

Re: PAM Kerberos error message issue

Dennis Handly — Fri, 11 May 2012 03:43:57 GMT

>Is there any solution?

Is there a mismatch?

ldd /usr/bin/kinit

(Does it point to /usr/lib/hpux32/libkrb5.so.1?)

Does this show both load modules:

swlist -l file KRB5-CLIENT | grep -e kinit -e libkrb5.so.1

Does "swverify KRB5-CLIENT" show any errors?

Re: PAM Kerberos error message issue

Chui Kock You_1 — Tue, 15 May 2012 03:03:06 GMT

Hi Dennis,

My answer are in red.

Regards,

Chui

Is there a mismatch?

1) ldd /usr/bin/kinit
(Does it point to /usr/lib/hpux32/libkrb5.so.1?)

root@uxkulh04> (/) $ ldd /usr/bin/kinit

/usr/bin/kinit:

libkrb5.so => /usr/lib/hpux32/libkrb5.so

libk5crypto.so => /usr/lib/hpux32/libk5crypto.so

libcom_err.so => /usr/lib/hpux32/libcom_err.so

libkrb5support.so => /usr/lib/hpux32/libkrb5support.so

libc.so.1 => /usr/lib/hpux32/libc.so.1

libdl.so.1 => /usr/lib/hpux32/libdl.so.1

2) Does this show both load modules:
swlist -l file KRB5-CLIENT | grep -e kinit -e libkrb5.so.1

root@uxkulh04> (/) $ swlist -l file KRB5-CLIENT | grep -e kinit -e libkrb5.so.1

ERROR: Software "KRB5-CLIENT" was not found on host "uxkulh04:/".

3) Does "swverify KRB5-CLIENT" show any errors?

root@uxkulh04> (/) $ swverify KRB5-CLIENT

======= 05/15/12 10:33:41 PDT BEGIN swverify SESSION

(non-interactive) (jobid=uxkulh04-0101)

* Session started for user "root@uxkulh04".

* Beginning Selection

* Target connection succeeded for "uxkulh04:/".

ERROR: Could not apply the software selection "KRB5-CLIENT"; it is

not available from depot or root "uxkulh04:/".

* Software selection failed for "uxkulh04:/".

ERROR: Cannot continue the "swverify" task.

* Selection had errors.

======= 05/15/12 10:33:42 PDT END swverify SESSION (non-interactive)

(jobid=uxkulh04-0101)

root@uxkulh04> (/) $ swlist | grep KRB

KRB5CLIENT E.1.6.2.09 Kerberos V5 Client Version 1.6.2.09

Re: PAM Kerberos error message issue

Dennis Handly — Tue, 15 May 2012 07:29:27 GMT

>libkrb5.so => /usr/lib/hpux32/libkrb5.so

Hmm, they did this wrong. What does /usr/lib/hpux32/libkrb5.so point to?

>ERROR: Software "KRB5-CLIENT" was not found on host

Ok, try:

swlist -l file KRB5CLIENT | grep -e kinit -e libkrb5.so.1

swverify KRB5CLIENT

Re: PAM Kerberos error message issue

Chui Kock You_1 — Tue, 15 May 2012 09:45:24 GMT

Hi Dennis,

Answer is in red.

>libkrb5.so => /usr/lib/hpux32/libkrb5.so

Hmm, they did this wrong. What does /usr/lib/hpux32/libkrb5.so point to?

root@uxkulh04> (/usr/lib/hpux32) $ find / -name libkrb5.so

/usr/lib/hpux32/libkrb5.so

/usr/lib/hpux64/libkrb5.so

root@uxkulh04> (/usr/lib/hpux32) $ ls -al /usr/lib/hpux32/libkrb5.so

-rwxr-xr-x 1 bin bin 1523952 Jun 18 2005 /usr/lib/hpux32/libkrb5.so

root@uxkulh04> (/usr/lib/hpux32) $ ls -al /usr/lib/hpux64/libkrb5.so

lr-xr-xr-x 1 bin bin 14 Sep 9 2009 /usr/lib/hpux64/libkrb5.so -> ./libkrb5.so.1

root@uxkulh04> (/usr/lib/hpux32) $

>ERROR: Software "KRB5-CLIENT" was not found on host

Ok, try:

swlist -l file KRB5CLIENT | grep -e kinit -e libkrb5.so.1
swverify KRB5CLIENT

root@uxkulh04> (/usr/lib/hpux32) $ swlist -l file KRB5CLIENT | grep -e kinit -e libkrb5.so.1

KRB5CLIENT.krb5client.KRB5-E-A-MAN-A: /opt/krb5client/share/man/man1.Z/kinit.1

KRB5CLIENT.krb5client.KRB5-J-E-MAN-A: /opt/krb5client/share/man/ja_JP.eucJP/man1.Z/kinit.1

KRB5CLIENT.krb5client.KRB5-J-S-MAN-A: /opt/krb5client/share/man/ja_JP.SJIS/man1.Z/kinit.1

KRB5CLIENT.krb5client.KRB5-RUN-A: /opt/krb5client/bin/kinit

KRB5CLIENT.krb5client.KRB5IA32SLIB-A: /opt/krb5client/lib/hpux32/libkrb5.so.1

KRB5CLIENT.krb5client.KRB5IA64SLIB-A: /opt/krb5client/lib/hpux64/libkrb5.so.1

root@uxkulh04> (/usr/lib/hpux32) $

----------------------------------------------------------------------------------------------------------------------------------------------------
root@uxkulh04> (/usr/lib/hpux32) $ swverify KRB5CLIENT

======= 05/15/12 17:20:33 PDT BEGIN swverify SESSION

(non-interactive) (jobid=uxkulh04-0104)

* Session started for user "root@uxkulh04".

* Beginning Selection

* Target connection succeeded for "uxkulh04:/".

* Software selections:

KRB5CLIENT,r=E.1.6.2.09,a=HP-UX_B.11.31_IA/PA,v=HP

+ NFS.NFS-CORE,l=/,r=B.11.31.06.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.06.01,fa=HP-UX_B.11.31_IA/PA

+ NFS.NFS-KRN,l=/,r=B.11.31.06.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.06.01,fa=HP-UX_B.11.31_IA

+ NFS.NFS-SHLIBS,l=/,r=B.11.31.06.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.06.01,fa=HP-UX_B.11.31_IA

+ NFS.NFS2-CORE,l=/,r=B.11.31.06.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.06.01,fa=HP-UX_B.11.31_IA

+ Networking.NET2-KRN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ Networking.NETTL-64SLIB,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ Networking.NETTL-MIN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ OS-Core.C-KRN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ OS-Core.CMDS-AUX,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA/PA

+ OS-Core.CMDS-MIN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA/PA

+ OS-Core.CMDS2-AUX,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ OS-Core.CMDS2-MIN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ OS-Core.CORE-KRN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA/PA

+ OS-Core.CORE-SHLIBS,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA/PA

+ OS-Core.CORE2-KRN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ OS-Core.CORE2-SHLIBS,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ OS-Core.KERN-RUN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA/PA

+ OS-Core.KERN2-RUN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ PHCO_38658.PROG2-AUX,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA

+ PHSS_41775.KRB5-64SLIB,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA

+ PHSS_41775.KRB5-ENG-A-MAN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA

+ PHSS_41775.KRB5-IA32SLIB,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA

+ PHSS_41775.KRB5-IA64SLIB,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA

+ PHSS_41775.KRB5-JPN-E-MAN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA

+ PHSS_41775.KRB5-JPN-S-MAN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA

+ PHSS_41775.KRB5-PRG,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA

+ PHSS_41775.KRB5-RUN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA

+ PHSS_41775.KRB5-SHLIB,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA

+ Streams.STREAMS-KRN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA/PA

+ Streams.STREAMS-RUN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA/PA

+ Streams.STREAMS2-KRN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ Streams.STREAMS2-RUN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ Streams-TIO.STRTIO-KRN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA/PA

+ Streams-TIO.STRTIO2-KRN,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

+ TextFormatters.TEXT-FMT,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA/PA

+ TextFormatters.TEXT2-FMT,l=/,r=B.11.31,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31,fa=HP-UX_B.11.31_IA

krb5client.KRB5-64SLIB-A,l=/,r=E.1.6.2.09,a=HP-UX_B.11.31_IA/PA,v=HP,fr=E.1.6.2.09,fa=HP-UX_B.11.31_IA

krb5client.KRB5-E-A-MAN-A,l=/,r=E.1.6.2.09,a=HP-UX_B.11.31_IA/PA,v=HP,fr=E.1.6.2.09,fa=HP-UX_B.11.31_IA/PA

krb5client.KRB5-J-E-MAN-A,l=/,r=E.1.6.2.09,a=HP-UX_B.11.31_IA/PA,v=HP,fr=E.1.6.2.09,fa=HP-UX_B.11.31_IA/PA

krb5client.KRB5-J-S-MAN-A,l=/,r=E.1.6.2.09,a=HP-UX_B.11.31_IA/PA,v=HP,fr=E.1.6.2.09,fa=HP-UX_B.11.31_IA/PA

krb5client.KRB5-PRG-A,l=/,r=E.1.6.2.09,a=HP-UX_B.11.31_IA/PA,v=HP,fr=E.1.6.2.09,fa=HP-UX_B.11.31_IA/PA

krb5client.KRB5-RUN-A,l=/,r=E.1.6.2.09,a=HP-UX_B.11.31_IA/PA,v=HP,fr=E.1.6.2.09,fa=HP-UX_B.11.31_IA

krb5client.KRB5-SHLIB-A,l=/,r=E.1.6.2.09,a=HP-UX_B.11.31_IA/PA,v=HP,fr=E.1.6.2.09,fa=HP-UX_B.11.31_IA

krb5client.KRB5IA32SLIB-A,l=/,r=E.1.6.2.09,a=HP-UX_B.11.31_IA/PA,v=HP,fr=E.1.6.2.09,fa=HP-UX_B.11.31_IA

krb5client.KRB5IA64SLIB-A,l=/,r=E.1.6.2.09,a=HP-UX_B.11.31_IA/PA,v=HP,fr=E.1.6.2.09,fa=HP-UX_B.11.31_IA

* A "+" indicates an automatic selection due to dependency or

the automatic selection of a patch or reference bundle.

* Selection succeeded.

* Beginning Analysis

* Session selections have been saved in the file

"/.sw/sessions/swverify.last".

WARNING: "uxkulh04:/": 270 files had warnings during this operation.

ERROR: "uxkulh04:/": 1202 files had errors during this operation.

* The analysis phase failed for "uxkulh04:/".

* Verification had errors.

NOTE: More information may be found in the agent logfile using the

command "swjob -a log uxkulh04-0104 @ uxkulh04:/".

======= 05/15/12 17:20:38 PDT END swverify SESSION (non-interactive)

(jobid=uxkulh04-0104)

Regards,

Chui

Re: PAM Kerberos error message issue

Dennis Handly — Wed, 23 May 2012 19:55:14 GMT

>-rwxr-xr-x 1 bin bin 1523952 Jun 18 2005 /usr/lib/hpux32/libkrb5.so
>lr-xr-xr-x 1 bin bin 14 Sep 9 2009 /usr/lib/hpux64/libkrb5.so -> ./libkrb5.so.1

The first is more likely to be your problem. It has a date of 2005 instead of 2009. Move it aside and create the symlink:

ln -s ./libkrb5.so.1 libkrb5.so

>* A "+" indicates an automatic selection due to dependency or

I guess we should have turned this off.

>ERROR: "uxkulh04:/": 1202 files had errors during this operation.

>swjob -a log uxkulh04-0104

You might want to do that swjob and redirect to a file. Then search that file for errors on libkrb5.so.

Re: PAM Kerberos error message issue

Chui Kock You_1 — Mon, 21 May 2012 08:05:54 GMT

Hi Dennis,

Any solution on the swjob log error message.

Regards,

Chui

Re: PAM Kerberos error message issue

Dennis Handly — Mon, 21 May 2012 09:23:33 GMT

>Any solution on the swjob log error message.

I'm waiting for you to rescan the swjob output for errors in that fileset, for libkrb5.so.

Otherwise lots of swverify errors are bogus, due to sloppy packaging.

Or redo the swverify to reduce the number of filesets:

swverify -x autoselect_dependencies=false KRB5CLIENT

Re: PAM Kerberos error message issue

Chui Kock You_1 — Tue, 22 May 2012 02:21:39 GMT

Hi Dennis,

The answer is in red.

Regards,

Chui

======= 05/22/12 09:13:09 SST BEGIN swverify SESSION

(non-interactive) (jobid=uxkulh04-0107)