You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@qpid.apache.org by Davide Anastasia <Da...@qualitycapital.com> on 2012/08/08 18:00:42 UTC
Setting up Kerberos security
Hi All,
Can anybody point me to a guide that could help me to setup Kerberos to
work with Qpid?
I've been trying to follow the steps described in the User Manual, but
Qpid still uses its SASL database for authentication.
Best,
Davide Anastasia
Analyst, Research & Development
Quality Capital Management Ltd.
QCM House * Horizon Business Village
No. 1 Brooklands Road
Weybridge * Surrey KT13 0TJ
United Kingdom
Tel: +44 (0) 1932 334 400
Fax: +44 (0) 1932 334 415
Email: Davide.Anastasia@QualityCapital.com
<ma...@QualityCapital.com>
www.qualitycapital.com <http://www.qualitycapital.com/>
________________________________
This email and any attachments are confidential and intended solely for
the use of the individual(s) to whom it is addressed.
Any views or opinions presented are solely those of the author and do
not necessarily represent those of Quality Capital Management Ltd. If
you are not the intended recipient, be advised that you have received
this email in error and that any use, dissemination, printing,
forwarding or copying of this email is strictly prohibited. Please
contact the sender if you have received this email in error. You should
also be aware that emails are susceptible to interference and you should
not assume that the contents of this email originated from the sender
above or that they have been accurately reproduced in their original
form. Quality Capital Management Ltd is authorised and regulated by the
Financial Services Authority in the UK and is a member of the National
Futures Association in the US.
________________________________
Re: Setting up Kerberos security
Posted by Gordon Sim <gs...@redhat.com>.
On 03/11/2013 10:38 AM, Davide Anastasia wrote:
> If I call again my tool, I get a slightly different error:
>
> 2013-03-11 10:34:25 warning Closing connection due to internal-error: Sasl error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server krbtgt/LOCALDOMAIN@QPID not found in Kerberos database) (qpid/SaslFactory.cpp:280)
> qpid::messaging::ConnectionError
> Error: internal-error: Sasl error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server krbtgt/LOCALDOMAIN@QPID not found in Kerberos database) (qpid/SaslFactory.cpp:280)
Have you created a server principal and included that in a keytab for
qpidd[1]? If so are you using the fully qualified hostname when connecting?
[1]
http://qpid.apache.org/books/0.20/AMQP-Messaging-Broker-CPP-Book/html/chap-Messaging_User_Guide-Security.html,
section 1.5.1.2.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
RE: Setting up Kerberos security
Posted by Davide Anastasia <Da...@qualitycapital.com>.
Hi Gordon,
I bring up again this topic because I am already struggling to enable Kerberos security in Qpid.
Just to summarize, I am on CentOS 6.3 with Qpid 0.14. Nothing has been installed from sources, so it should be pretty much like RHEL.
I have disabled SELinux on this box and I am using QPID as realm.
The file attached is what I am using to connect to/test the broker.
Calling my tool gives me this:
2013-03-11 10:32:44 warning Closing connection due to internal-error: Sasl error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credentials cache file '/tmp/krb5cc_526' not found) (qpid/SaslFactory.cpp:280)
qpid::messaging::ConnectionError
Error: internal-error: Sasl error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credentials cache file '/tmp/krb5cc_526' not found) (qpid/SaslFactory.cpp:280)
Of course, I can do kinit:
-bash-4.1$ kinit
Password for davide@QPID:
-bash-4.1$
...which seems to work!
If I call again my tool, I get a slightly different error:
2013-03-11 10:34:25 warning Closing connection due to internal-error: Sasl error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server krbtgt/LOCALDOMAIN@QPID not found in Kerberos database) (qpid/SaslFactory.cpp:280)
qpid::messaging::ConnectionError
Error: internal-error: Sasl error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server krbtgt/LOCALDOMAIN@QPID not found in Kerberos database) (qpid/SaslFactory.cpp:280)
I am not sure what I should blame (my tool, the broker configuration, kerberos configuration?), so I am a bit stuck with this problem and I am not sure what I should look for on the internet.
I look forward to hearing from you. Any hint will be of great help.
Thanks,
Davide
-----Original Message-----
From: Gordon Sim [mailto:gsim@redhat.com]
Sent: 14 August 2012 17:16
To: users@qpid.apache.org
Subject: Re: Setting up Kerberos security
On 08/14/2012 03:03 PM, Davide Anastasia wrote:
> I've created the keytab file as specified in the Qpid user manual [1]
> and I have set the environment variable as well.
What about the realm? Have you set that? (Previous error message looked like you were using EXAMPLE.COM?)
> However, I haven't figured out a way to understand where the broker is
> actually looking for this file.
The krb5.conf file points to various logs that may help (the kdc may actually be another box of course, but the log there is very useful).
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Setting up Kerberos security
Posted by Gordon Sim <gs...@redhat.com>.
On 08/14/2012 03:03 PM, Davide Anastasia wrote:
> I've created the keytab file as specified in the Qpid user manual [1]
> and I have set the environment variable as well.
What about the realm? Have you set that? (Previous error message looked
like you were using EXAMPLE.COM?)
> However, I haven't figured out a way to understand where the broker is
> actually looking for this file.
The krb5.conf file points to various logs that may help (the kdc may
actually be another box of course, but the log there is very useful).
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
RE: Setting up Kerberos security
Posted by Davide Anastasia <Da...@qualitycapital.com>.
I've created the keytab file as specified in the Qpid user manual [1]
and I have set the environment variable as well.
However, I haven't figured out a way to understand where the broker is
actually looking for this file.
Thanks a lot for your help, I really appreciate.
Davide
[1]
http://qpid.apache.org/books/trunk/AMQP-Messaging-Broker-CPP-Book/html/c
hap-Messaging_User_Guide-Security.html
-----Original Message-----
From: Gordon Sim [mailto:gsim@redhat.com]
Sent: 14 August 2012 12:35
To: users@qpid.apache.org
Subject: Re: Setting up Kerberos security
On 08/14/2012 11:33 AM, Davide Anastasia wrote:
> Yes, I can kinit the server without problem.
Ok, that is good. The next thing to check is that the qpidd process can
access the keytab in which its service principal can be found.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For additional
commands, e-mail: users-help@qpid.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Setting up Kerberos security
Posted by Gordon Sim <gs...@redhat.com>.
On 08/14/2012 11:33 AM, Davide Anastasia wrote:
> Yes, I can kinit the server without problem.
Ok, that is good. The next thing to check is that the qpidd process can
access the keytab in which its service principal can be found.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
RE: Setting up Kerberos security
Posted by Davide Anastasia <Da...@qualitycapital.com>.
Hi,
Yes, I can kinit the server without problem.
I'll go thru the document linked to see whether my krb5.conf is set
correctly.
Best,
Davide
-----Original Message-----
From: Gordon Sim [mailto:gsim@redhat.com]
Sent: 13 August 2012 12:38
To: users@qpid.apache.org
Subject: Re: Setting up Kerberos security
On 08/13/2012 12:25 PM, Davide Anastasia wrote:
> Hi Gordon,
> I'm trying to setup my Kerberos subsystem, hence I don't exclude there
> are errors in my current configuration.
> Is there anything that I should check more specifically?
The first test is whether you can kinit a user successfully on the
machine(s) from which you wish to run any qpid components. That step
doesn't involve those qpid components at all, but ensures that the
kerberos setup is valid.
If you have a pre-existing KDC for example, then it will check that the
krb5.conf correctly points at it (in the error message the realm used is
EXAMPLE.COM, which sounds liker it has not been explicitly configured).
A useful reference might be
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-singl
e/Managing_Smart_Cards/index.html#Using_Kerberos
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Setting up Kerberos security
Posted by Gordon Sim <gs...@redhat.com>.
On 08/13/2012 12:25 PM, Davide Anastasia wrote:
> Hi Gordon,
> I'm trying to setup my Kerberos subsystem, hence I don't exclude there
> are errors in my current configuration.
> Is there anything that I should check more specifically?
The first test is whether you can kinit a user successfully on the
machine(s) from which you wish to run any qpid components. That step
doesn't involve those qpid components at all, but ensures that the
kerberos setup is valid.
If you have a pre-existing KDC for example, then it will check that the
krb5.conf correctly points at it (in the error message the realm used is
EXAMPLE.COM, which sounds liker it has not been explicitly configured).
A useful reference might be
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Managing_Smart_Cards/index.html#Using_Kerberos
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
RE: Setting up Kerberos security
Posted by Davide Anastasia <Da...@qualitycapital.com>.
Hi Gordon,
I'm trying to setup my Kerberos subsystem, hence I don't exclude there
are errors in my current configuration.
Is there anything that I should check more specifically?
Thanks,
Davide
-----Original Message-----
From: Gordon Sim [mailto:gsim@redhat.com]
Sent: 10 August 2012 15:40
To: users@qpid.apache.org
Subject: Re: Setting up Kerberos security
On 08/09/2012 05:55 PM, Davide Anastasia wrote:
> Hi,
> I'm using the C++ messaging API to connect to the broker. cyrus-sasl
> is available.
> After changing /etc/sasl2/qpidd.conf, I receive this error:
>
> 2012-08-09 17:55:20 warning Closing connection due to internal-error:
> Sasl error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS
> failure. Minor code may provide more information (Server
> krbtgt/COM@EXAMPLE.COM not found in Kerberos database)
> (qpid/SaslFactory.cpp:280)
> unknown file: Failure
> C++ exception with description "internal-error: Sasl error: SASL(-1):
> generic failure: GSSAPI Error: Unspecified GSS failure. Minor code
> may provide more information (Server krbtgt/COM@EXAMPLE.COM not found
> in Kerberos database) (qpid/SaslFactory.cpp:280)" thrown in the test
body.
Ok, did you setup your own KDC, or are you using an existing Kerberos
setup? That sounds like an issue with your /etc/krb5.conf file. Does
kinit work?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For additional
commands, e-mail: users-help@qpid.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Setting up Kerberos security
Posted by Gordon Sim <gs...@redhat.com>.
On 08/09/2012 05:55 PM, Davide Anastasia wrote:
> Hi,
> I'm using the C++ messaging API to connect to the broker. cyrus-sasl is
> available.
> After changing /etc/sasl2/qpidd.conf, I receive this error:
>
> 2012-08-09 17:55:20 warning Closing connection due to internal-error:
> Sasl error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS
> failure. Minor code may provide more information (Server
> krbtgt/COM@EXAMPLE.COM not found in Kerberos database)
> (qpid/SaslFactory.cpp:280)
> unknown file: Failure
> C++ exception with description "internal-error: Sasl error: SASL(-1):
> generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may
> provide more information (Server krbtgt/COM@EXAMPLE.COM not found in
> Kerberos database) (qpid/SaslFactory.cpp:280)" thrown in the test body.
Ok, did you setup your own KDC, or are you using an existing Kerberos
setup? That sounds like an issue with your /etc/krb5.conf file. Does
kinit work?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
RE: Setting up Kerberos security
Posted by Davide Anastasia <Da...@qualitycapital.com>.
Hi,
I'm using the C++ messaging API to connect to the broker. cyrus-sasl is
available.
After changing /etc/sasl2/qpidd.conf, I receive this error:
2012-08-09 17:55:20 warning Closing connection due to internal-error:
Sasl error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS
failure. Minor code may provide more information (Server
krbtgt/COM@EXAMPLE.COM not found in Kerberos database)
(qpid/SaslFactory.cpp:280)
unknown file: Failure
C++ exception with description "internal-error: Sasl error: SASL(-1):
generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may
provide more information (Server krbtgt/COM@EXAMPLE.COM not found in
Kerberos database) (qpid/SaslFactory.cpp:280)" thrown in the test body.
Best,
Davide
-----Original Message-----
From: Gordon Sim [mailto:gsim@redhat.com]
Sent: 09 August 2012 15:40
To: users@qpid.apache.org
Subject: Re: Setting up Kerberos security
On 08/09/2012 02:52 PM, Davide Anastasia wrote:
> Hi Gordon,
> I'm using the C++ broker, v. 0.14, the one shipped with RHEL6.
> I have used the guide in your page to set up the Kerberos server,
> without success.
Ok, and what client(s) are you using to connect?
> How can I explicitly require GSSAPI as the mechanism?
You can either explicitly limit the broker to only support that one
mechanism by editing the 'mech_list' option in /etc/sasl2/qpidd.conf,
e.g.
mech_list: GSSAPI
Alternatively, you can specify through the client options which
mechanism you want to use (the broker must also support it)
> How can I change
> it in the /etc/sasl2/qpidd.conf file?
As above, just edit the mech_list. Make sure if specified that it
includes GSSAPI (if not specified at all it will allow all mechanisms
for which plugins are installed).
> I'm just checking whether the
> cyrus-sasl is available.
Try rpm -qv cyrus-sasl-gssapi.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For additional
commands, e-mail: users-help@qpid.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Setting up Kerberos security
Posted by Gordon Sim <gs...@redhat.com>.
On 08/09/2012 02:52 PM, Davide Anastasia wrote:
> Hi Gordon,
> I'm using the C++ broker, v. 0.14, the one shipped with RHEL6.
> I have used the guide in your page to set up the Kerberos server,
> without success.
Ok, and what client(s) are you using to connect?
> How can I explicitly require GSSAPI as the mechanism?
You can either explicitly limit the broker to only support that one
mechanism by editing the 'mech_list' option in /etc/sasl2/qpidd.conf, e.g.
mech_list: GSSAPI
Alternatively, you can specify through the client options which
mechanism you want to use (the broker must also support it)
> How can I change
> it in the /etc/sasl2/qpidd.conf file?
As above, just edit the mech_list. Make sure if specified that it
includes GSSAPI (if not specified at all it will allow all mechanisms
for which plugins are installed).
> I'm just checking whether the
> cyrus-sasl is available.
Try rpm -qv cyrus-sasl-gssapi.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Setting up Kerberos security
Posted by Pavel Moravec <pm...@redhat.com>.
Hi Davide,
add to /etc/sasl2/qpidd.conf:
mech_list: GSSAPI
to stick qpid broker in enforcing just that type of SASL mechanism.
If you require to set it in the client, then it depends on what client/tool do you use. I.e.
qpid-config --sasl-mechanism=GSSAPI ..
C++ spout/drain: ./drain --connection-options '{sasl_mechanisms:GSSAPI, username:guest, password:guest }' ..
Java client: ./run_example.sh org.apache.qpid.example.Drain --broker-option=sasl_mechs=GSSAPI
Kind regards,
Pavel
----- Original Message -----
> From: "Davide Anastasia" <Da...@qualitycapital.com>
> To: users@qpid.apache.org
> Sent: Thursday, August 9, 2012 3:52:49 PM
> Subject: RE: Setting up Kerberos security
>
> Hi Gordon,
> I'm using the C++ broker, v. 0.14, the one shipped with RHEL6.
> I have used the guide in your page to set up the Kerberos server,
> without success.
>
> How can I explicitly require GSSAPI as the mechanism? How can I
> change
> it in the /etc/sasl2/qpidd.conf file? I'm just checking whether the
> cyrus-sasl is available.
>
> Best,
> Davide
>
> -----Original Message-----
> From: Gordon Sim [mailto:gsim@redhat.com]
> Sent: 09 August 2012 10:05
> To: users@qpid.apache.org
> Subject: Re: Setting up Kerberos security
>
> On 08/08/2012 05:00 PM, Davide Anastasia wrote:
> > Hi All,
> >
> > Can anybody point me to a guide that could help me to setup
> > Kerberos
> > to work with Qpid?
>
> Which broker are you using? qpidd (i.e. c++) or qpid-server (Java).
>
> If the former, is
> http://qpid.apache.org/books/0.16/AMQP-Messaging-Broker-CPP-Book/html/ch
> ap-Messaging_User_Guide-Security.html
> the text you have already seen?
>
> > I've been trying to follow the steps described in the User Manual,
> > but
>
> > Qpid still uses its SASL database for authentication.
>
> Which client are you using, and are you explicitly requesting GSSAPI
> as
> the mechanism? If using qpidd, does your /etc/sasl2/qpidd.conf file
> have
> the mech_list set and does the list include GSSAPI? Do you have the
> cyrus-sasl gssapi module installed?
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> additional
> commands, e-mail: users-help@qpid.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
RE: Setting up Kerberos security
Posted by Davide Anastasia <Da...@qualitycapital.com>.
Hi Gordon,
I'm using the C++ broker, v. 0.14, the one shipped with RHEL6.
I have used the guide in your page to set up the Kerberos server,
without success.
How can I explicitly require GSSAPI as the mechanism? How can I change
it in the /etc/sasl2/qpidd.conf file? I'm just checking whether the
cyrus-sasl is available.
Best,
Davide
-----Original Message-----
From: Gordon Sim [mailto:gsim@redhat.com]
Sent: 09 August 2012 10:05
To: users@qpid.apache.org
Subject: Re: Setting up Kerberos security
On 08/08/2012 05:00 PM, Davide Anastasia wrote:
> Hi All,
>
> Can anybody point me to a guide that could help me to setup Kerberos
> to work with Qpid?
Which broker are you using? qpidd (i.e. c++) or qpid-server (Java).
If the former, is
http://qpid.apache.org/books/0.16/AMQP-Messaging-Broker-CPP-Book/html/ch
ap-Messaging_User_Guide-Security.html
the text you have already seen?
> I've been trying to follow the steps described in the User Manual, but
> Qpid still uses its SASL database for authentication.
Which client are you using, and are you explicitly requesting GSSAPI as
the mechanism? If using qpidd, does your /etc/sasl2/qpidd.conf file have
the mech_list set and does the list include GSSAPI? Do you have the
cyrus-sasl gssapi module installed?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For additional
commands, e-mail: users-help@qpid.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org
Re: Setting up Kerberos security
Posted by Gordon Sim <gs...@redhat.com>.
On 08/08/2012 05:00 PM, Davide Anastasia wrote:
> Hi All,
>
> Can anybody point me to a guide that could help me to setup Kerberos to
> work with Qpid?
Which broker are you using? qpidd (i.e. c++) or qpid-server (Java).
If the former, is
http://qpid.apache.org/books/0.16/AMQP-Messaging-Broker-CPP-Book/html/chap-Messaging_User_Guide-Security.html
the text you have already seen?
> I've been trying to follow the steps described in the User Manual, but
> Qpid still uses its SASL database for authentication.
Which client are you using, and are you explicitly requesting GSSAPI as
the mechanism? If using qpidd, does your /etc/sasl2/qpidd.conf file have
the mech_list set and does the list include GSSAPI? Do you have the
cyrus-sasl gssapi module installed?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org