Ok, so now I'm confused. This should have been fixed in Debian, as Sam
Hartman shows us, here:
krb5 (1.8.1+dfsg-3) unstable; urgency=high
* CVE-2010-1321 GSS-API accept sec context null pointer deref, Closes:
#582261
* Force use of bash for build, Closes: #581473
* Start slapd before krb5 when krb5-kdc-ldap installed, Closes:
#582122
-- Sam Hartman <hartm...@debian.org> Wed, 19 May 2010 16:37:36 -0400
Testing this on natty by installing krb5-kdc-ldap, and then slapd:
# ls -l /etc/rc2.d
total 4
-rw-r--r-- 1 root root 677 Nov 1 09:36 README
lrwxrwxrwx 1 root root 18 Feb 4 07:55 S18krb5-kdc -> ../init.d/krb5-kdc
lrwxrwxrwx 1 root root 15 Feb 4 07:56 S19slapd -> ../init.d/slapd
lrwxrwxrwx 1 root root 18 Nov 2 09:51 S99ondemand -> ../init.d/ondemand
lrwxrwxrwx 1 root root 18 Nov 2 09:51 S99rc.local -> ../init.d/rc.local
The problem is that the override isn't being respected, because it
relies on insserv being called. insserv isn't called, because on Ubuntu
systems, legacy-bootordering is the norm, so this override will not help
unfortunately. If I manually run 'insserv' as root, this does reorder
things:
# ls -l /etc/rc2.d
total 4
-rw-r--r-- 1 root root 677 Nov 1 09:36 README
lrwxrwxrwx 1 root root 15 Feb 4 08:04 S01slapd -> ../init.d/slapd
lrwxrwxrwx 1 root root 18 Feb 4 08:04 S02krb5-kdc -> ../init.d/krb5-kdc
lrwxrwxrwx 1 root root 18 Feb 4 08:04 S03ondemand -> ../init.d/ondemand
lrwxrwxrwx 1 root root 18 Feb 4 08:04 S03rc.local -> ../init.d/rc.local
So, this is really caused by Ubuntu's sysv-rc disabling insserv. Since
Ubuntu has chosen a different boot, this is just going to be something
we have to maintain delta for I think.
In this case I think the right fix for Ubuntu is going to be to add this to
krb5-kdc-slapd's postinst:
update-rc.d slapd remove
update-rc.d slapd start 17 2 3 4 5 . stop 19 0 1 6 .
Either way, I have to agree that I was wrong, and this does have a
solution and so can be set to Confirmed. I'll also raise the importance
to Low, because the default config does not work in what would probably
be a very common use case (kdc on the same box as ldap).
The workaround, btw, is to run the two update-rc.d commands above, or
'insserv'.
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-1321
** Changed in: krb5 (Ubuntu)
Status: Opinion => Confirmed
** Changed in: krb5 (Ubuntu)
Importance: Wishlist => Low
--
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to krb5 in ubuntu.
https://bugs.launchpad.net/bugs/652433
Title:
Init script dependency error: krb5-kdc starts before slapd
--
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
