Your message dated Wed, 14 Dec 2005 14:21:54 -0800
with message-id <[EMAIL PROTECTED]>
and subject line Bug#340360: fixed in libapache-mod-auth-kerb 4.996-5.0-rc6-3
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 23 Nov 2005 00:08:16 +0000
>From [EMAIL PROTECTED] Tue Nov 22 16:08:16 2005
Return-path: <[EMAIL PROTECTED]>
Received: from smtp3.stanford.edu ([171.67.16.138])
by spohr.debian.org with esmtp (Exim 4.50)
id 1EeiBM-0006ug-GL
for [EMAIL PROTECTED]; Tue, 22 Nov 2005 16:08:16 -0800
Received: from windlord.stanford.edu (windlord.Stanford.EDU [171.64.19.147])
by smtp3.Stanford.EDU (8.12.11/8.12.11) with ESMTP id jAN08F6c023399
for <[EMAIL PROTECTED]>; Tue, 22 Nov 2005 16:08:15 -0800
Received: by windlord.stanford.edu (Postfix, from userid 1000)
id 175AEE78F1; Tue, 22 Nov 2005 16:08:15 -0800 (PST)
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Russ Allbery <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: libapache2-mod-auth-kerb: GSSAPI fails with "Request is a replay"
under krb5
1.4.3
X-Mailer: reportbug 3.17
Date: Tue, 22 Nov 2005 16:08:15 -0800
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
Package: libapache2-mod-auth-kerb
Version: 4.996-5.0-rc6-1
Severity: important
krb5 1.4.3 has just been uploaded to experimental and will hopefully be
uploaded to unstable soon. In testing it, I found that mod_auth_kerb
(at least with Apache 2 -- I haven't tested with Apache 1) doesn't work
correctly with 1.4.3 when doing GSSAPI authentication. The attempted
web page access hangs from the perspective of the browser, and Apache
repeatedly logs the following:
[Tue Nov 22 16:04:42 2005] [debug] src/mod_auth_kerb.c(1322): [client
171.64.19. 147] kerb_authenticate_user entered with user (NULL) and auth_type
Kerberos
[Tue Nov 22 16:04:42 2005] [debug] src/mod_auth_kerb.c(1023): [client
171.64.19. 147] Acquiring creds for HTTP/[EMAIL PROTECTED]
[Tue Nov 22 16:04:42 2005] [debug] src/mod_auth_kerb.c(1152): [client
171.64.19. 147] Verifying client data using KRB5 GSS-API
[Tue Nov 22 16:04:42 2005] [debug] src/mod_auth_kerb.c(1168): [client
171.64.19. 147] Verification returned code 851968
[Tue Nov 22 16:04:42 2005] [error] [client 171.64.19.147]
gss_accept_sec_context() failed: Miscellaneous failure (Request is a replay)
Those log messages repeat until I press stop in the browser. Downgrading
the libraries to 1.3 causes the module to start working again.
My guess is that mod_auth_kerb is violating some assumption made in the
Kerberos libraries, but I've not had a chance to investigate more completely
yet. I hope to over the next few days. I'd like to get this fixed before
1.4.3 goes into unstable, for obvious reasons.
-- System Information:
Debian Release: testing/unstable
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12-1-686
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) (ignored: LC_ALL set to C)
Versions of packages libapache2-mod-auth-kerb depends on:
ii apache2-common 2.0.54-5 next generation, scalable, extenda
ii krb5-config 1.8 Configuration files for Kerberos V
ii libc6 2.3.5-6 GNU C Library: Shared libraries an
ii libcomerr2 1.38-2 common error description library
ii libkrb53 1.3.6-5 MIT Kerberos runtime libraries
libapache2-mod-auth-kerb recommends no packages.
-- no debconf information
---------------------------------------
Received: (at 340360-close) by bugs.debian.org; 14 Dec 2005 22:31:02 +0000
>From [EMAIL PROTECTED] Wed Dec 14 14:31:02 2005
Return-path: <[EMAIL PROTECTED]>
Received: from katie by spohr.debian.org with local (Exim 4.50)
id 1Emf0U-0001eY-Ho; Wed, 14 Dec 2005 14:21:54 -0800
From: Ghe Rivero <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.60 $
Subject: Bug#340360: fixed in libapache-mod-auth-kerb 4.996-5.0-rc6-3
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Wed, 14 Dec 2005 14:21:54 -0800
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
Source: libapache-mod-auth-kerb
Source-Version: 4.996-5.0-rc6-3
We believe that the bug you reported is fixed in the latest version of
libapache-mod-auth-kerb, which is due to be installed in the Debian FTP archive:
libapache-mod-auth-kerb_4.996-5.0-rc6-3.diff.gz
to
pool/main/liba/libapache-mod-auth-kerb/libapache-mod-auth-kerb_4.996-5.0-rc6-3.diff.gz
libapache-mod-auth-kerb_4.996-5.0-rc6-3.dsc
to
pool/main/liba/libapache-mod-auth-kerb/libapache-mod-auth-kerb_4.996-5.0-rc6-3.dsc
libapache-mod-auth-kerb_4.996-5.0-rc6-3_i386.deb
to
pool/main/liba/libapache-mod-auth-kerb/libapache-mod-auth-kerb_4.996-5.0-rc6-3_i386.deb
libapache2-mod-auth-kerb_4.996-5.0-rc6-3_i386.deb
to
pool/main/liba/libapache-mod-auth-kerb/libapache2-mod-auth-kerb_4.996-5.0-rc6-3_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Ghe Rivero <[EMAIL PROTECTED]> (supplier of updated libapache-mod-auth-kerb
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Wed, 14 Dec 2005 12:39:55 +0100
Source: libapache-mod-auth-kerb
Binary: libapache-mod-auth-kerb libapache2-mod-auth-kerb
Architecture: source i386
Version: 4.996-5.0-rc6-3
Distribution: unstable
Urgency: low
Maintainer: Ghe Rivero <[EMAIL PROTECTED]>
Changed-By: Ghe Rivero <[EMAIL PROTECTED]>
Description:
libapache-mod-auth-kerb - apache module for Kerberos authentication
libapache2-mod-auth-kerb - apache2 module for Kerberos authentication
Closes: 340360
Changes:
libapache-mod-auth-kerb (4.996-5.0-rc6-3) unstable; urgency=low
.
* Fix: GSSAPI fails with "Request is a replay" under krb5 1.4.3.
Closes:#340360
* Updated policy Version to 3.6.2
Files:
7e8f677ab8cc48e17f5b85ad2835dc38 776 web optional
libapache-mod-auth-kerb_4.996-5.0-rc6-3.dsc
2f60ca290c5d70784a721e21cad2ca84 40308 web optional
libapache-mod-auth-kerb_4.996-5.0-rc6-3.diff.gz
4523d26322b0c6206c060f1fd079acb8 24134 web optional
libapache-mod-auth-kerb_4.996-5.0-rc6-3_i386.deb
37f6d8f17acbe591f58c6f1df0bce8ab 25620 web optional
libapache2-mod-auth-kerb_4.996-5.0-rc6-3_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDoIdC+YXjQAr8dHYRAjlPAJ9ttSox0pydDj66TYUOnf9sJOCAOACgwl+/
5XL9NTE0q3fmhNSpTFdNnQU=
=zA9M
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
