kerberos_server: allow choosing MIT or Heimdal #31832

kwohlfahrt · 2017-11-19T16:26:36Z

Motivation for this change

Allow using MIT Kerberos as a kerberos server, and add some initial configuration. Related to #29623.

This is my first PR, let me know if anything is not suitable.

As far as I can tell the upstream kerberos_server service was broken, as it expected binaries to be in sbin while they were in bin (see ab6c57e). There were previously no tests, this adds some basic smoke tests.

I'm happy to add more configurable options, I've so far just configured what I'm familiar with. In theory it should be possible to serve multiple realms from one server, but I don't need this and haven't been able to get it to work easily so it's not part of this PR.

Adding the usual set of plain-text configuration is difficult, as MIT and Heimdal take slightly different formats of options.

Things done

Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- other Linux distributions
Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

joachifm · 2018-02-20T19:30:55Z

@GrahamcOfBorg test kerberos.mit kerberos.heimdal

GrahamcOfBorg · 2018-02-20T19:31:14Z

Failure on aarch64-linux (full log)

Partial log (click to expand)

�[31;1merror:�[0m attribute 'kerberos' in selection path 'tests.kerberos.mit' not found

GrahamcOfBorg · 2018-02-20T19:31:23Z

Failure on x86_64-linux (full log)

Partial log (click to expand)

error: attribute 'kerberos' in selection path 'tests.kerberos.mit' not found

kwohlfahrt · 2018-02-26T17:06:25Z

@joachifm are there any specific changes you'd like me to make? Tests pass for me locally, and CI seems happy now.

As of 13e6a5c all user binaries (kinit, kadmin, etc) are installed with krb5Full.dev. This is a little counter-intuitive to me, especially since the commit only mentions moving headers. @vcunat as you are the author of that commit, should these binaries be moved to the default output?

vcunat · 2018-02-26T20:53:25Z

I think the point here was krb5-config, as that needs to keep reference to the headers. I was focused on the case of type == "lib".

kwohlfahrt · 2018-02-27T21:42:27Z

That makes sense - I will move the other programs back to the default output then unless there is an objection? Should there be separate 'bin' and 'lib' or 'out' and 'lib' outputs or should these go together?

vcunat · 2018-02-28T12:55:53Z

The type == "lib" has almost nothing there, and for the other cases it's probably not important whether they're together or not.

eqyiel · 2018-02-28T23:12:27Z

@kwohlfahrt thanks for making an effort to fix this.

I had some similar changes in mind that I never got around to finishing: eqyiel@4114381

I'll probably try to apply it on top of your changes at some point 😸

matthewbauer · 2018-04-21T19:49:20Z

Looks okay to me. Any objections to merging?

matthewbauer · 2018-04-21T19:49:59Z

@GrahamcOfBorg test kerberos

GrahamcOfBorg · 2018-04-21T19:53:03Z

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: tests.kerberos

Partial log (click to expand)

Cannot nix-instantiate `tests.kerberos' because:
�[31;1merror:�[0m attribute 'kerberos' in selection path 'tests.kerberos' not found

matthewbauer

Looks good but we cannot test it until tests.kerberos is in release.nix

kwohlfahrt · 2018-07-18T16:29:28Z

@peterhoeg this is building locally now, but Graham has an error that "target branch staging doesn't evaluate" - should I be targeting a different branch?

EDIT: All I did was rebase onto the latest staging. That fixed the libdrm issue in a local build.

peterhoeg · 2018-07-19T04:08:28Z

Thanks for doing all this hard work!

The staging part is probably due to the change to pkgs/development/libraries/kerberos/krb5.nix as I am assuming this will cause a significant amount of rebuilding.

I will not be able to review this in detail in the near future - the arrival of our twins is imminent now so I'm hoping @vcunat or @FRidh (or others) will be able to dedicate the time this PR deserves.

kwohlfahrt · 2018-07-23T08:30:32Z

This is now rebased, and tests pass locally.

@peterhoeg congratulations!

tcpd doesn't have sbin anymore (so it was broken), and heimdal just symlinks to bin.

Don't use socket activation, as inetd is discouraged by heimdal documentation.

General cleanup before adding more options.

script causes problems for forking services like MIT Kerberos.

Allow switching out kerberos server implementation. Sharing config is probably sensible, but implementation is different enough to be worth splitting into two files. Not sure this is the correct way to split an implementation, but it works for now. Uses the switch from config.krb5 to select implementation.

Could also move kdc.conf, but this makes it inconvenient to use command line utilities with heimdal, as it would require specifying --config-file with every command.

Leave options for multiple realms for similarity to krb5, and future expansion. Currently not tested because I can't make it work and don't need it.

This contains all of the user binaries as of 13e6a5c.

The intention of the previous change was to move krb5-config to .dev (it gives the locations of headers), but it grabbed all of the user-facing binaries too. This puts them back.

Mic92 · 2018-12-11T17:38:30Z

This was open for too long.

kwohlfahrt · 2018-12-11T20:20:55Z

I think this closes #39424 as well.

kwohlfahrt force-pushed the kerberos branch from d82a2b0 to 53c33d8 Compare November 19, 2017 16:27

kwohlfahrt changed the title ~~Kerberos~~ kerberos_server: allow choosing MIT or Heimdal Nov 19, 2017

GrahamcOfBorg added 10.rebuild-darwin: 0 10.rebuild-linux: 0 labels Nov 19, 2017

kwohlfahrt force-pushed the kerberos branch from 53c33d8 to 9e27c0e Compare November 27, 2017 21:33

kwohlfahrt force-pushed the kerberos branch from 9e27c0e to db0c584 Compare December 9, 2017 19:27

kwohlfahrt force-pushed the kerberos branch from db0c584 to 7330249 Compare January 2, 2018 21:30

kwohlfahrt force-pushed the kerberos branch from 7330249 to 5723626 Compare February 26, 2018 15:45

GrahamcOfBorg added 6.topic: nixos 8.has: module (update) labels Feb 26, 2018

GrahamcOfBorg added 10.rebuild-darwin: 501+ 10.rebuild-linux: 501+ and removed 10.rebuild-darwin: 0 10.rebuild-linux: 0 labels Mar 1, 2018

kwohlfahrt force-pushed the kerberos branch from 39264e7 to 77034bd Compare April 4, 2018 20:36

matthewbauer requested a review from vcunat April 21, 2018 19:48

matthewbauer changed the base branch from master to staging April 21, 2018 19:49

NixOS deleted a comment from GrahamcOfBorg Apr 21, 2018

matthewbauer requested changes Apr 21, 2018

View reviewed changes

kwohlfahrt force-pushed the kerberos branch from bf950df to 73c6289 Compare July 18, 2018 16:22

kwohlfahrt force-pushed the kerberos branch from 73c6289 to 5db8dc7 Compare July 22, 2018 22:06

kwohlfahrt force-pushed the kerberos branch from 5db8dc7 to e3143fe Compare August 27, 2018 10:43

kwohlfahrt force-pushed the kerberos branch from e3143fe to 3c3e864 Compare September 16, 2018 11:12

GrahamcOfBorg added the 10.rebuild-darwin-stdenv label Sep 16, 2018

kwohlfahrt force-pushed the kerberos branch from 3c3e864 to 998e160 Compare October 15, 2018 10:33

kwohlfahrt force-pushed the kerberos branch 3 times, most recently from 1140dae to 13e2cd3 Compare November 12, 2018 12:00

kwohlfahrt requested a review from infinisil as a code owner November 12, 2018 12:00

kwohlfahrt force-pushed the kerberos branch from 13e2cd3 to 26f6e33 Compare December 7, 2018 16:43

Kai Wohlfahrt and others added 10 commits December 11, 2018 13:33

kerberos-server: Fix sbin paths

dfdd348

tcpd doesn't have sbin anymore (so it was broken), and heimdal just symlinks to bin.

kerberos-server: move kadmind to systemd

ee3bd73

Don't use socket activation, as inetd is discouraged by heimdal documentation.

kerberos-server: cleanup of kerberos.nix

4f9af77

General cleanup before adding more options.

kerberos-server: switch to ExecStart

fe8f2b8

script causes problems for forking services like MIT Kerberos.

kerberos_server: Keep ACL file in store

4e4a599

Could also move kdc.conf, but this makes it inconvenient to use command line utilities with heimdal, as it would require specifying --config-file with every command.

kerberos_server: ensure only one realm configured

f5b4918

Leave options for multiple realms for similarity to krb5, and future expansion. Currently not tested because I can't make it work and don't need it.

kerberos: explicitly install krb5Full.dev for tests

d752677

This contains all of the user binaries as of 13e6a5c.

kerberos: move user binaries to default output

ade842f

The intention of the previous change was to move krb5-config to .dev (it gives the locations of headers), but it grabbed all of the user-facing binaries too. This puts them back.

kerberos: Add tests/kerberos to release.nix

337bc20

kwohlfahrt force-pushed the kerberos branch from 26f6e33 to 337bc20 Compare December 11, 2018 13:33

Mic92 merged commit eefbc08 into NixOS:staging Dec 11, 2018

kwohlfahrt deleted the kerberos branch December 11, 2018 20:21

Janik-Haag added the 12. first-time contribution label Jun 12, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

kerberos_server: allow choosing MIT or Heimdal #31832

kerberos_server: allow choosing MIT or Heimdal #31832

kwohlfahrt commented Nov 19, 2017 •

edited by grahamc

joachifm commented Feb 20, 2018

GrahamcOfBorg commented Feb 20, 2018

GrahamcOfBorg commented Feb 20, 2018

kwohlfahrt commented Feb 26, 2018

vcunat commented Feb 26, 2018

kwohlfahrt commented Feb 27, 2018

vcunat commented Feb 28, 2018 •

edited

eqyiel commented Feb 28, 2018

matthewbauer commented Apr 21, 2018

matthewbauer commented Apr 21, 2018 •

edited

GrahamcOfBorg commented Apr 21, 2018

matthewbauer left a comment

kwohlfahrt commented Jul 18, 2018 •

edited

peterhoeg commented Jul 19, 2018

kwohlfahrt commented Jul 23, 2018

Mic92 commented Dec 11, 2018

kwohlfahrt commented Dec 11, 2018

kerberos_server: allow choosing MIT or Heimdal #31832

kerberos_server: allow choosing MIT or Heimdal #31832

Conversation

kwohlfahrt commented Nov 19, 2017 • edited by grahamc

Motivation for this change

Things done

joachifm commented Feb 20, 2018

GrahamcOfBorg commented Feb 20, 2018

GrahamcOfBorg commented Feb 20, 2018

kwohlfahrt commented Feb 26, 2018

vcunat commented Feb 26, 2018

kwohlfahrt commented Feb 27, 2018

vcunat commented Feb 28, 2018 • edited

eqyiel commented Feb 28, 2018

matthewbauer commented Apr 21, 2018

matthewbauer commented Apr 21, 2018 • edited

GrahamcOfBorg commented Apr 21, 2018

matthewbauer left a comment

Choose a reason for hiding this comment

kwohlfahrt commented Jul 18, 2018 • edited

peterhoeg commented Jul 19, 2018

kwohlfahrt commented Jul 23, 2018

Mic92 commented Dec 11, 2018

kwohlfahrt commented Dec 11, 2018

kwohlfahrt commented Nov 19, 2017 •

edited by grahamc

vcunat commented Feb 28, 2018 •

edited

matthewbauer commented Apr 21, 2018 •

edited

kwohlfahrt commented Jul 18, 2018 •

edited