September 2014 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 899118] Kerberized Printing to Windows AD Print Server/Share
by bugzilla_noreply＠novell.com 30 Sep '14

30 Sep '14

http://bugzilla.suse.com/show_bug.cgi?id=899118 --- Comment #4 from Joschi Brauchle <joschibrauchle(a)gmx.de> --- (In reply to Johannes Meixner from comment #3) > Johannes, > > We used to exercise this approach, where cupsd would get > a TGT and allow backends to re-issue tickets as needed. > But back in CUPS 1.6 or so we dropped doing so > (too fragile, difficult to deploy on Wi-Fi networks) > and instead have the IPP backend (and the SMB backend > on OS X - can't speak to what is being done on Linux for Samba) > "trampoline" into the user account to send the print job > as the user, with the user's Kerberos session... > Naturally this doesn't work for a print server daisy chaining > to another server, e.g.: > > Client ----> Server -----> Server with Printer > > but then Kerberos has trouble with this sort of trust > relationship anyways... Thank you for clearing this up. So it is true what was stated in the bug description that this "forwarding functionality" was dropped. As far as I can see, this is the case for CUPS 1.5 already. We have also tried to use the approach described in Michael Sweets answer with openSUSE 13.1: Let CUPS "trampoline" into a *local* users session and use the *locally available* credentials to allow for kerberized SMB printing, but failed to get this working here. So it seems like the SMB backend for OS X is different than the Linux one, in the sense that it offers this additional functionality... Should I split this into a new but report, as this is a somewhat simplified problem? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 899118] Kerberized Printing to Windows AD Print Server/Share
by bugzilla_noreply＠novell.com 30 Sep '14

30 Sep '14

http://bugzilla.suse.com/show_bug.cgi?id=899118 --- Comment #3 from Johannes Meixner <jsmeix(a)suse.com> --- I asked on the CUPS user discussion list <cups(a)cups.org> ------------------------------------------------------------------------------ Date: Tue, 30 Sep 2014 12:32:17 +0200 (CEST) From: Johannes Meixner <jsmeix(a)suse.de> Reply-To: The CUPS user discussion list. <cups(a)cups.org> To: cups(a)cups.org Subject: [cups] Supports CUPS Kerberos ticket saving and forwarding for backends? Hello, we (i.e. openSUSE) got this issue report: https://bugzilla.suse.com/show_bug.cgi?id=899118 Therein a user describes that CUPS 1.4 had some kind of Kerberos ticket saving and forwarding functionality so that the cupsd would save a Kerberos Ticket Granting Ticket (TGT) that it got via Kerberos from a client (e.g. a "lp" program) and then the cupsd could forward that TGT to a backend (e.g. the smb backend) so that the backend could use the TGT from the client to do Kerberos authentication at its recipient (e.g. a SMB printer share on a Windows AD Print Server). I am not at all a Kerberos expert but as far as I know, Kerberos authentication in CUPS belongs only to the IPP protocol (i.e. CUPS clients, the cupsd, and the ipp backend) but Kerberos authentication at a Windows AD Print Server (than belongs more or less to the SMB protocol) has nothing to do with the Kerberos functionality in CUPS. As far as I understand it, the Kerberos stuff in CUPS does not apply when data should be sent to a SMB server where a SMB printer share is and that printer share requires authentication via Kerberos. My understanding is that CUPS backends (except the ipp backend) are basically external tools for CUPS. Accordingly I think Samba's smb backend itself must implement whatever is needed to send the data to to a SMB server where a SMB printer share is and if that printer share requires authentication via Kerberos, then Samba's smb backend itself must implement whatever is needed for the authentication. But again I am not at all a Kerberos expert. Therefore I could be wrong and there is really some kind of Kerberos ticket forwarding (or TGT -> "normal ticket") mechanism inside CUPS. If there is really some kind of Kerberos ticket saving and forwarding in CUPS, I would like to know where I can get more detailed information about it. Currently I only know about http://cups.org/documentation.php/doc-1.7/kerberos.html Kind Regards Johannes Meixner ------------------------------------------------------------------------------ The CUPS main author replied this: ------------------------------------------------------------------------------ Date: Tue, 30 Sep 2014 07:37:19 -0400 From: Michael Sweet <msweet(a)apple.com> Reply-To: The CUPS user discussion list. <cups(a)cups.org> To: The CUPS user discussion list. <cups(a)cups.org> Subject: Re: [cups] Supports CUPS Kerberos ticket saving and forwarding for backends? Johannes, We used to exercise this approach, where cupsd would get a TGT and allow backends to re-issue tickets as needed. But back in CUPS 1.6 or so we dropped doing so (too fragile, difficult to deploy on Wi-Fi networks) and instead have the IPP backend (and the SMB backend on OS X - can't speak to what is being done on Linux for Samba) "trampoline" into the user account to send the print job as the user, with the user's Kerberos session... Naturally this doesn't work for a print server daisy chaining to another server, e.g.: Client ----> Server -----> Server with Printer but then Kerberos has trouble with this sort of trust relationship anyways... Michael Sweet, Senior Printing System Engineer, PWG Chair ------------------------------------------------------------------------------ -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 898470] Bug changes not forwarded to mailinglist (since upgrade)
by bugzilla_noreply＠novell.com 30 Sep '14

30 Sep '14

http://bugzilla.opensuse.org/show_bug.cgi?id=898470 --- Comment #3 from Bernhard Wiedemann <bwiedemann(a)suse.com> --- looks good now. mails arriving on the ML since ~ 00:20 UTC today -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 899157] New: osc service disabled run has exit code 0 on failure
by bugzilla_noreply＠novell.com 30 Sep '14

30 Sep '14

http://bugzilla.suse.com/show_bug.cgi?id=899157 Bug ID: 899157 Summary: osc service disabled run has exit code 0 on failure Classification: Internal Novell Products Product: openSUSE Build Service Version: master Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: source services Assignee: adrian(a)suse.com Reporter: aspiers(a)suse.com QA Contact: adrian(a)suse.com Found By: Development Blocker: --- ~/IBS/Devel/Cloud/4/crowbar-barclamp-nova_dashboard $ osc service dr Cloning into '/tmp/tmpQIkaRt/tmpUyd3Ua/barclamp-nova_dashboard.git'... HEAD is now at ea30f00 Merge pull request #186 from dirkmueller/release/stoney/master _servicedata: Failed to parse ([Errno 2] No such file or directory: '/tmp/tmpQIkaRt/_servicedata') Cleaning: /tmp/tmpQIkaRt/tmpUyd3Ua Aborting: service call failed: /usr/lib/obs/service/tar_scm --url 'git://github.com/crowbar/barclamp-nova_dashboard.git' --scm 'git' --exclude '.git' --exclude '.gitreview' --filename 'crowbar-barclamp-nova_dashboard' --versionformat '1.8+git.%ct.%h' --revision 'release/stoney/master' --changesgenerate 'enable' --outdir /tmp/tmpQIkaRt ~/IBS/Devel/Cloud/4/crowbar-barclamp-nova_dashboard $ echo $? 0 This breaks any scripts which wrap around it. This is similar to bug 747942, where 'osc build' has the same issue. Fix proposed in https://github.com/openSUSE/osc/pull/115 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 881506] mod_access_compat doesn't seem to work anymore
by bugzilla_noreply＠novell.com 30 Sep '14

30 Sep '14

http://bugzilla.suse.com/show_bug.cgi?id=881506 Petr Gajdos <pgajdos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lnussel(a)suse.com Flags| |needinfo?(lnussel(a)suse.com) --- Comment #3 from Petr Gajdos <pgajdos(a)suse.com> --- Ludwig, even if I am not able to find corresponding entry in spec/usptream changelog, it looks like 2.4.10 in factory works as expected. Could you double check, please? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 898738] Can`t launch poezio Jabber client
by bugzilla_noreply＠novell.com 30 Sep '14

30 Sep '14

http://bugzilla.opensuse.org/show_bug.cgi?id=898738 Bernhard Wiedemann <bwiedemann(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED CC| |bwiedemann(a)suse.com, | |pascal.bleser(a)opensuse.org --- Comment #1 from Bernhard Wiedemann <bwiedemann(a)suse.com> --- I had a look at the version from https://build.opensuse.org/package/show/server:messaging/poezio and saw that the package has not been touched for 3 years, so is probably unmaintained and has more issues. I installed the python-configparser backport from python3 found that the default config is looked for in the wrong place, workarounded with cp -a /usr/share/poezio/data/default_config.cfg /usr/lib/data/ and then still get # poezio Traceback (most recent call last): File "/usr/lib/poezio/poezio.py", line 28, in <module> from connection import connection File "/usr/lib/poezio/connection.py", line 83, in <module> connection = Connection() File "/usr/lib/poezio/connection.py", line 52, in __init__ sleekxmpp.ClientXMPP.__init__(self, jid, password, ssl=True) TypeError: __init__() got an unexpected keyword argument 'ssl' I guess most of the trouble is coming from openSUSE using python2 and poezio expecting python3 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 899158] New: systemd doesn't mount separate home partition
by bugzilla_noreply＠novell.com 30 Sep '14

30 Sep '14

http://bugzilla.suse.com/show_bug.cgi?id=899158 Bug ID: 899158 Summary: systemd doesn't mount separate home partition Classification: openSUSE Product: openSUSE Factory Version: 201409* Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Basesystem Assignee: systemd-maintainers(a)suse.de Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- As seen here systemd doesn't mount a separate home partition: https://openqa.opensuse.org/tests/25091/modules/first_boot/steps/1 linux-ow3k:~ # l /home total 16 drwxr-xr-x 1 root root 0 Sep 30 07:37 ./ drwxr-xr-x 1 root root 136 Sep 30 07:42 ../ linux-ow3k:~ # systemctl start home.mount linux-ow3k:~ # systemctl status home.mount home.mount - /home Loaded: loaded (/etc/fstab) Active: active (mounted) since Tue 2014-09-30 07:47:21 EDT; 3s ago Where: /home What: /dev/disk/by-uuid/1803f207-3e2a-4cc4-8344-ea9438b6d76d Process: 1475 ExecMount=/bin/mount -n -t xfs (code=exited, status=0/SUCCESS) linux-ow3k:~ # mount /home linux-ow3k:~ # l /home total 16 drwxr-xr-x 3 root root 22 Sep 30 07:41 ./ drwxr-xr-x 1 root root 136 Sep 30 07:42 ../ drwxr-xr-x 7 bernhard users 207 Sep 30 07:41 bernhard/ linux-ow3k:~ # exit Related to bug 898240? -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 899118] Kerberized Printing to Windows AD Print Server/Share
by bugzilla_noreply＠novell.com 30 Sep '14

30 Sep '14

http://bugzilla.suse.com/show_bug.cgi?id=899118 --- Comment #2 from Joschi Brauchle <joschibrauchle(a)gmx.de> --- (In reply to Johannes Meixner from comment #1) Yes, 1) CUPS Negotiate Authentication and 2) Kerberos Authentication to Windows print queue *can* be two separate things. But if a shared Windows printer requires Kerberos authentication and is to be offered to Linux clients through a remote CUPS server, the remote CUPS SMB backend needs to acquire Kerberos credentials for said Windows print queue. One (out of many) possibilities is that the CUPS server itself requires "negotiate" authentication from the Linux client and requests a forwardable TGT. Hence, we arrive at the combination of both 1) + 2) which used to work in openSUSE 12.3 and CUPS 1.4 as mentioned above. The CUPS SMB backend was actually extended by openSUSE through the (somewhat misleadingly named) "samba-krb-printing" package. This package now passes the users TGT to the original SMB backend to allow authentication against the Windows print server. The name "samba-krb-printing" is misleading in my opinion, because the package provides a CUPS backend for kerberized SMB printing. It should be named "cups-backend-kerberized-smb" or similar. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 887904] New: nagios changes permissions on /tmp upon restart
by bugzilla_noreply＠novell.com 30 Sep '14

30 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=887904 https://bugzilla.novell.com/show_bug.cgi?id=887904#c0 Summary: nagios changes permissions on /tmp upon restart Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Other AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: wagner-thomas(a)gmx.at QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 systemctl restart nagios.service results in a change of the permission of /tmp nagios:/ # dir / | grep tmp drwxrwxrwt 7 root root 4096 Jul 18 12:30 tmp nagios:/ # systemctl restart nagios.service nagios:/ # dir / | grep tmp drwxr-xr-x 7 nagios nagios 4096 Jul 18 12:30 tmp nagios:/ # This is quite annoying since with the new permission lot of other stuff gets broken. Lots of X-Server based stuff isn't working with the new permissions (like xdm or x2go) Reproducible: Always nagios:/ # zypper info nagios Loading repository data... Reading installed packages... Information for package nagios: ------------------------------- Repository: server:monitoring Name: nagios Version: 4.0.7-114.1 Arch: x86_64 Vendor: obs://build.opensuse.org/server:monitoring Installed: Yes Status: up-to-date Installed Size: 962.6 KiB Summary: The Nagios Network Monitor Description: Nagios is a program that will monitor hosts and services on your network. It has the ability to email or page you when a problem arises and when a problem is resolved. Nagios is written in C and is designed to run under Linux (and some other *NIX variants) as a background process, intermittently running checks on various services that you specify. The actual service checks are performed by separate "plugin" programs which return the status of the checks to Nagios. The plugins are available at http://sourceforge.net/projects/nagiosplug This package provides core programs for Nagios. The web interface, documentation, and development files are built as separate packages -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 5

[Bug 688020] New: No password for nagios given after installing via packages.
by bugzilla_noreply＠novell.com 30 Sep '14

30 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=688020 https://bugzilla.novell.com/show_bug.cgi?id=688020#c0 Summary: No password for nagios given after installing via packages. Classification: openSUSE Product: openSUSE 11.4 Version: Factory Platform: Other OS/Version: openSUSE 11.4 Status: NEW Severity: Major Priority: P5 - None Component: Other AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: grey_0x1a(a)yahoo.com QAContact: qa(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux i686; rv:2.0.0) Gecko/20100101 Firefox/4.0 I tried to install nagios via the Suse packages. I think they might have worked correctly, but there is no given password for nagiosadmin which appears to be the configure superuser of nagios. I could not find any documentation on how to change this anywhere on the web, since I could not find a .htaccess, htpasswd file on the system to modify. I used 'find / -name "*htd*"', 'find / -name "*htp*"', and 'find / -name "*htac*"' to try and find the correct file but no joy. So I will give up and install from source. What is the point of these packages if you do not document what the password is? Reproducible: Always Steps to Reproduce: 1.install nagios package includeing nagios-www 2.turn on appache (httpd) and nagios via yast 3. try and log in via localhost/nagios but you can't because you don't know the password and black does not work. Maybe other things I don't know. Actual Results: you get a server error page. Server error! The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there was an error in a CGI script. If you think this is a server error, please contact the webmaster. Error 500 localhost Sat Apr 16 18:49:49 2011 Apache/2.2.17 (Linux/SUSE) Expected Results: A better page than that. I don't know nagios so I really can't say what to do here. But it does not help that I think you guys have spent some time getting it to work and I can't use it because of the password issue. Your wiki page http://en.opensuse.org/Nagios It not helpful in part because it looks like it implying to install half from source, which I would avoid like the plague and tell everyone else to do as well. I think this is documentation problem but I am not sure. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 3