Обсуждение: Fwd: psql+krb5

2009/11/30 rahimeh khodadadi <rahimeh.khodadadi@gmail.com>:
>
>
> ---------- Forwarded message ----------
> From: rahimeh khodadadi <rahimeh.khodadadi@gmail.com>
> Date: 2009/11/29
> Subject: Re: psql+krb5
> To: Denis Feklushkin <denis.feklushkin@gmail.com>

Please review the guidelines for reporting a problem, which you can find here:

http://wiki.postgresql.org/wiki/Guide_to_reporting_problems

It seems to me that you've done the exact opposite of nearly
everything suggested there, starting with cross-posting your email to
four mailing lists at least three of which are irrelevant to the
problem that you're attempting to solve.

...Robert

Except that he posted a month ago and got no answers...

On Tue, Dec 1, 2009 at 8:22 AM, Robert Haas <robertmhaas@gmail.com> wrote:
> 2009/11/30 rahimeh khodadadi <rahimeh.khodadadi@gmail.com>:
>>
>>
>> ---------- Forwarded message ----------
>> From: rahimeh khodadadi <rahimeh.khodadadi@gmail.com>
>> Date: 2009/11/29
>> Subject: Re: psql+krb5
>> To: Denis Feklushkin <denis.feklushkin@gmail.com>
>
> Please review the guidelines for reporting a problem, which you can find here:
>
> http://wiki.postgresql.org/wiki/Guide_to_reporting_problems
>
> It seems to me that you've done the exact opposite of nearly
> everything suggested there, starting with cross-posting your email to
> four mailing lists at least three of which are irrelevant to the
> problem that you're attempting to solve.
>
> ...Robert
>
> --
> Sent via pgsql-general mailing list (pgsql-general@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-general
>



--
When fascism comes to America, it will be intolerance sold as diversity.

On Tue, Dec 1, 2009 at 11:26 AM, Scott Marlowe <scott.marlowe@gmail.com> wrote:
> Except that he posted a month ago and got no answers...

Gee, I wonder why.

...Robert

I've dropped all your cross-posts; this is just going to PgSQL-general.

On 30/11/2009 3:29 PM, rahimeh khodadadi wrote:

> psql: *krb5_sendauth: Bad application version was sent (via sendauth)*

Have you verified that your Kerberos setup is otherwise working
correctly - it's handling logins, other apps work, etc?

Also: a search for your error message finds this post, which, while
related to a Windows kerberos server, seems to apply:

http://www.mail-archive.com/pgsql-general@postgresql.org/msg80403.html

That is: Make sure that the Kerberos service name matches everywhere.

I don't know much about Kerberos, not I suspect do all that many people
on the list, so I can't be of any more help.

--
Craig Ringer

* Craig Ringer (craig@postnewspapers.com.au) wrote:
> I've dropped all your cross-posts; this is just going to PgSQL-general.

Thanks for that.

> On 30/11/2009 3:29 PM, rahimeh khodadadi wrote:
>
>> psql: *krb5_sendauth: Bad application version was sent (via sendauth)*
>
> Also: a search for your error message finds this post, which, while
> related to a Windows kerberos server, seems to apply:

It's the same kind of issue (wrong service name), but I think the real
problem is this:

krb_srvname = 'postgres/star@EXAMPLE.COM'

The documentation, I think, is pretty clear:
http://www.postgresql.org/docs/8.4/interactive/auth-methods.html#KERBEROS-AUTH

 PostgreSQL operates like a normal Kerberos service. The name of the
 service principal is servicename/hostname@realm.

 servicename can be set on the server side using the krb_srvname
 configuration parameter

The above should just be:

krb_srvname = 'postgres'

Or, better, just removed.  Unless you're running under a Microsoft
Active Directory Kerberos environment, the default should 'just work'.

Additionally, this is also almost certainly wrong:

krb_server_hostname = 'star'

Again, referring to the same documentation:

  hostname is the fully qualified host name of the server machine.

You really should have a proper FQDN set for this system.  I would also
recommend using a real domain rather than 'EXAMPLE.COM'.  Also, I didn't
see the version of PostgreSQL, but if you're using something recent your
auth method should really be 'gss' instead of 'krb5'.

> I don't know much about Kerberos, not I suspect do all that many people
> on the list, so I can't be of any more help.

Unfortunately, I don't pay as close attention to the lists as I wish I
could.  Kerberos with PG is actually a solution I typically recommend.

    Thanks,

        Stephen