Linux

httpd 程序無法讀取 krb5.conf

  • August 13, 2015

我有一個關於 kerberos / httpd / RHEL 的問題

系統一

這是有問題的系統。

OS: RHEL 6.6
Kernel: 2.6.32-431.29.2.el6.x86_64
CPU: Intel Xeon X5570

伺服器上執行著一個 Kerberized 網站。

系統 2

該系統使用相同的 kerberos 配置。

OS: RHEL 6.5
Kernel: 2.6.32-431.23.3.el6.x86_64
CPU: Intel Xeon E5-2697

還執行一個kerberized網站。

問題

當使用者訪問網站時，apache 錯誤日誌（LogLevel 調試）中會顯示以下消息，並且使用者會收到“內部伺服器錯誤”頁面：

[Tue Aug 07 11:22:03 2015] [debug] src/mod_auth_kerb.c(1944): [client 10.70.30.50] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Tue Aug 07 11:22:03 2015] [debug] src/mod_auth_kerb.c(1279): [client 10.70.30.50] Acquiring creds for HTTP/app-srv.domain.ch
[Tue Aug 07 11:22:03 2015] [debug] src/mod_auth_kerb.c(1139): [client 10.70.30.50] GSS-API major_status:00020000, minor_status:000186a4
[Tue Aug 07 11:22:03 2015] [error] [client 10.70.30.50] gss_acquire_cred() failed: An invalid name was supplied (, )

通過更改權限，可以在系統 2 上重現此錯誤，/etc/krb5.conf因此執行 apache 程序 (apache) 的使用者無法讀取文件。

兩個系統上的權限/etc/krb5.conf都設置為root:root 644

我可以使用sudo -u apache cat /etc/krb5.conf.

調試資訊系統 1

使用 strace( ps h --ppid $(sudo cat /var/run/httpd/httpd.pid) | awk '{print"-p " $1}' | xargs sudo strace -o /tmp/stracehttpd.log) 進行調試時，系統 1 將產生這些結果（僅顯示 apache 子程序正在訪問的片段/etc/krb5.conf）：

30216 fcntl(13, F_GETFD <unfinished ...>
30214 poll([{fd=14, events=POLLIN}], 1, 60000 <unfinished ...>
30216 <... fcntl resumed> )             = 0
30216 fcntl(13, F_SETFD, FD_CLOEXEC)    = 0
30216 getsockname(13, {sa_family=AF_INET6, sin6_port=htons(80), inet_pton(AF_INET6, "::ffff:10.70.30.50", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0
30216 fcntl(13, F_GETFL)                = 0x2 (flags O_RDWR)
30216 fcntl(13, F_SETFL, O_RDWR|O_NONBLOCK) = 0
30216 read(13, "GET /le HTTP/1.1\r\nHost: app-s"..., 8000) = 3519
30216 write(7, "[Tue Aug 11 14:47:03 2015] [debu"..., 155) = 155
30216 write(7, "[Tue Aug 11 14:47:03 2015] [debu"..., 134) = 134
30216 futex(0x7f04b63a00a0, FUTEX_WAKE_PRIVATE, 2147483647) = 0
30216 stat("/etc/gss/mech", 0x7ffff7f3d540) = -1 ENOENT (No such file or directory)
30216 stat("/etc/gss/mech", 0x7ffff7f3d490) = -1 ENOENT (No such file or directory)
30216 stat("/etc/krb5.conf", 0x7ffff7f39090) = -1 EACCES (Permission denied)
30216 stat("/etc/krb5.conf", 0x7ffff7f39090) = -1 EACCES (Permission denied)
30216 stat("/etc/krb5.conf", 0x7ffff7f39090) = -1 EACCES (Permission denied)
30216 stat("/etc/krb5.conf", 0x7ffff7f39090) = -1 EACCES (Permission denied)
30216 stat("/etc/gss/mech", 0x7ffff7f3d350) = -1 ENOENT (No such file or directory)
30216 stat("/etc/gss/mech", 0x7ffff7f3d2a0) = -1 ENOENT (No such file or directory)
30216 stat("/etc/krb5.conf", 0x7ffff7f38db0) = -1 EACCES (Permission denied)
30216 stat("/etc/krb5.conf", 0x7ffff7f38db0) = -1 EACCES (Permission denied)
30216 stat("/etc/krb5.conf", 0x7ffff7f38db0) = -1 EACCES (Permission denied)
30216 stat("/etc/krb5.conf", 0x7ffff7f38db0) = -1 EACCES (Permission denied)
30216 write(7, "[Tue Aug 11 14:47:03 2015] [debu"..., 137) = 137
30216 write(7, "[Tue Aug 11 14:47:03 2015] [erro"..., 118) = 118
30216 writev(13, [{"HTTP/1.1 500 Internal Server Err"..., 160}, {"<!DOCTYPE HTML PUBLIC \"-//IETF//"..., 625}], 2) = 785
30214 <... poll resumed> )              = 1 ([{fd=14, revents=POLLIN}])
30216 write(9, "10.70.30.50 - - [11/Aug/2015:14"..., 242) = 242
30214 read(14,  <unfinished ...>
30216 shutdown(13, 1 /* send */)        = 0
30214 <... read resumed> "HTTP/1.1 500 Internal Server Err"..., 8000) = 785
30216 poll([{fd=13, events=POLLIN}], 1, 2000 <unfinished ...>

調試資訊系統 2

使用 strace ( ps h --ppid $(sudo cat /var/run/httpd/httpd.pid) | awk '{print"-p " $1}' | xargs sudo strace -o /tmp/stracehttpd.log) 進行調試時，系統 2 將產生以下結果（僅顯示 apache 子程序正在訪問 /etc/krb5.conf 的片段）：

6423  <... accept resumed> {sa_family=AF_INET6, sin6_port=htons(51438), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 13
6424  read(14,  <unfinished ...>
6423  fcntl(13, F_GETFD <unfinished ...>
6424  <... read resumed> 0x7f1ad64e7198, 8000) = -1 EAGAIN (Resource temporarily unavailable)
6423  <... fcntl resumed> )             = 0
6424  poll([{fd=14, events=POLLIN}], 1, 60000 <unfinished ...>
6423  fcntl(13, F_SETFD, FD_CLOEXEC)    = 0
6423  getsockname(13, {sa_family=AF_INET6, sin6_port=htons(80), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0
6423  fcntl(13, F_GETFL)                = 0x2 (flags O_RDWR)
6423  fcntl(13, F_SETFL, O_RDWR|O_NONBLOCK) = 0
6423  read(13, "GET /le HTTP/1.1\r\nHost: app-srv.dom"..., 8000) = 3082
6423  gettimeofday({1439292761, 106843}, NULL) = 0
6423  gettimeofday({1439292761, 107010}, NULL) = 0
6423  write(7, "[Tue Aug 11 13:32:41 2015] [debu"..., 146) = 146
6423  gettimeofday({1439292761, 107124}, NULL) = 0
6423  write(7, "[Tue Aug 11 13:32:41 2015] [debu"..., 115) = 115
6423  futex(0x7f1aca0ae308, FUTEX_WAKE_PRIVATE, 2147483647) = 0
6423  futex(0x7f1aca0ae290, FUTEX_WAKE_PRIVATE, 2147483647) = 0
6423  futex(0x7f1acaa090a0, FUTEX_WAKE_PRIVATE, 2147483647) = 0
6423  stat("/etc/gss/mech", 0x7fff7298d2e0) = -1 ENOENT (No such file or directory)
6423  stat("/etc/gss/mech", 0x7fff7298d230) = -1 ENOENT (No such file or directory)
6423  futex(0x7f1aca7c52c0, FUTEX_WAKE_PRIVATE, 2147483647) = 0
6423  futex(0x7f1aca7c5750, FUTEX_WAKE_PRIVATE, 2147483647) = 0
6423  gettimeofday({1439292761, 107404}, NULL) = 0
6423  stat("/etc/krb5.conf", {st_mode=S_IFREG|0644, st_size=2294, ...}) = 0
6423  open("/etc/krb5.conf", O_RDONLY)  = 14
6423  fcntl(14, F_SETFD, FD_CLOEXEC)    = 0
6423  brk(0x7f1ad6504000)               = 0x7f1ad6504000
6423  fstat(14, {st_mode=S_IFREG|0644, st_size=2294, ...}) = 0
6423  mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1ad535d000
6423  read(14, "[logging]\n default = FILE:/var/l"..., 4096) = 2294
6423  read(14, "", 4096)                = 0
6423  close(14)                         = 0
6423  munmap(0x7f1ad535d000, 4096)      = 0
6423  gettimeofday({1439292761, 107642}, NULL) = 0
6423  gettimeofday({1439292761, 107663}, NULL) = 0
6423  open("/dev/urandom", O_RDONLY)    = 14
6423  fcntl(14, F_SETFD, FD_CLOEXEC)    = 0
6423  fstat(14, {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
6423  read(14, "bh\357\327\333\316\321\327\37\0\215[\37\331\213?o\34\272\246\303].\227\367p\23\225\356\352\272>"..., 64) = 64
6423  close(14)                         = 0
6423  open("/dev/urandom", O_RDONLY)    = 14
6423  fcntl(14, F_SETFD, FD_CLOEXEC)    = 0
6423  fstat(14, {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
6423  read(14, "N\301;|\377'\370\32\214u!%\234\25\21\365\10gi\227\362\273\321\373\324,\321\306*~\323\334"..., 64) = 64
6423  close(14)                         = 0
6423  futex(0x7f1aca4dd2c0, FUTEX_WAKE_PRIVATE, 2147483647) = 0
6423  gettimeofday({1439292761, 107952}, NULL) = 0

附加資訊

兩個系統上的 kerberos 配置相同。我還有一個成功執行相同 kerberos 配置的 Ubuntu 12.04 系統。/etc/krb5.conf除了拒絕訪問apache 使用者之外，我無法在 System 2 上重現該錯誤。

檢查selinux。這看起來可能會干擾。

（這實際上是問題所在，正如已刪除的評論中所討論的那樣）。

引用自：https://serverfault.com/questions/713617

相關問答

Linux

如何指示 Apache HTTPd 僅服務於特定 IP 地址組

  • July 2, 2022
檢視問答
Linux

從 Active Directory 檢索目前的 Kerberos KVNO

  • February 11, 2022
檢視問答
Linux

對 Ubuntu 上 kerberized NFSv4 主機的根訪問

  • October 4, 2021
檢視問答
Linux

從具有多個 SPN 的 AD 文件創建 kerberos 密鑰表

  • June 15, 2021
檢視問答
Linux

Apache VHost 配置優先級？

  • May 27, 2021
檢視問答
Linux

Kinit 不會連接到域伺服器：獲取初始憑據時域不是 KDC 本地的

  • May 4, 2021
檢視問答