Обсуждение: Segmentation fault on FreeBSD with GSSAPI authentication

Hi All,

I am trying to use GSSAPI (Kerberos auth) on FreeBSD.

After several attempts I was able to build PostgreSQL 16 from FreeBSD ports with GSSAPI support. The steps were:
1. Uninstall Heimdal
2. Install krb5 (MIT Kerberos)
3. Build Pg with GSSAPI support

I configured pg_hba.conf to require GSSAPI authentication for one of the users.

When trying to connect using “psql -h postgres” (postgres is the name of the host) I get:

psql: error: connection to server at “postgres.[domainname]” ([ipaddress]), port 5432 failed: connection to server at
“postgres.[domainname]”([ipaddress]), port 5432 failed: server closed the connection unexpectedly 
    This probably means the server terminated abnormally
    before or while processing the request.

Configured Pg to debug log and here are the relevant syslog entries:


an 27 13:33:45 postgres postgres[61605]: [36-1] 2024-01-27 13:33:45.779 CET [61605] DEBUG:  forked new backend,
pid=61626socket=10 
Jan 27 13:33:45 postgres postgres[61605]: [37-1] 2024-01-27 13:33:45.786 CET [61605] DEBUG:  forked new backend,
pid=61627socket=10 
Jan 27 13:33:45 postgres postgres[61605]: [38-1] 2024-01-27 13:33:45.786 CET [61605] DEBUG:  reaping dead processes
Jan 27 13:33:45 postgres postgres[61605]: [39-1] 2024-01-27 13:33:45.787 CET [61605] DEBUG:  server process (PID 61626)
wasterminated by signal 11: Segmentation fault 
Jan 27 13:33:45 postgres postgres[61605]: [40-1] 2024-01-27 13:33:45.787 CET [61605] LOG:  server process (PID 61626)
wasterminated by signal 11: Segmentation fault 
Jan 27 13:33:45 postgres postgres[61605]: [41-1] 2024-01-27 13:33:45.787 CET [61605] LOG:  terminating any other active
serverprocesses 
Jan 27 13:33:45 postgres postgres[61605]: [42-1] 2024-01-27 13:33:45.787 CET [61605] DEBUG:  sending SIGQUIT to process
61611
Jan 27 13:33:45 postgres postgres[61605]: [43-1] 2024-01-27 13:33:45.787 CET [61605] DEBUG:  sending SIGQUIT to process
61627
Jan 27 13:33:45 postgres postgres[61605]: [44-1] 2024-01-27 13:33:45.787 CET [61605] DEBUG:  sending SIGQUIT to process
61607
Jan 27 13:33:45 postgres postgres[61605]: [45-1] 2024-01-27 13:33:45.787 CET [61605] DEBUG:  sending SIGQUIT to process
61606
Jan 27 13:33:45 postgres postgres[61605]: [46-1] 2024-01-27 13:33:45.787 CET [61605] DEBUG:  sending SIGQUIT to process
61609
Jan 27 13:33:45 postgres postgres[61605]: [47-1] 2024-01-27 13:33:45.787 CET [61605] DEBUG:  sending SIGQUIT to process
61610
Jan 27 13:33:45 postgres postgres[61605]: [48-1] 2024-01-27 13:33:45.789 CET [61605] DEBUG:  reaping dead processes
Jan 27 13:33:45 postgres postgres[61605]: [49-1] 2024-01-27 13:33:45.789 CET [61605] DEBUG:  server process (PID 61627)
exitedwith exit code 2 



I am not familiar enough with FreeBSD to be able to gather any crash dumps or backtraces, I am afraid.

--
Michal

=?utf-8?Q?Micha=C5=82_K=C5=82eczek?= <michal@kleczek.org> writes:
> I am trying to use GSSAPI (Kerberos auth) on FreeBSD.

> After several attempts I was able to build PostgreSQL 16 from FreeBSD ports with GSSAPI support. The steps were:
> 1. Uninstall Heimdal
> 2. Install krb5 (MIT Kerberos)
> 3. Build Pg with GSSAPI support

Which FreeBSD version?  Which krb5 package version?
Is this x86_64, or something else?

            regards, tom lane

> On 27 Jan 2024, at 15:43, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> =?utf-8?Q?Micha=C5=82_K=C5=82eczek?= <michal@kleczek.org> writes:
>> I am trying to use GSSAPI (Kerberos auth) on FreeBSD.
>
>> After several attempts I was able to build PostgreSQL 16 from FreeBSD ports with GSSAPI support. The steps were:
>> 1. Uninstall Heimdal
>> 2. Install krb5 (MIT Kerberos)
>> 3. Build Pg with GSSAPI support
>
> Which FreeBSD version?  Which krb5 package version?
> Is this x86_64, or something else?

Right, sorry:

1. X86_64
2. FreeBSD 13.2 (It is in a TrueNAS Jail if it makes any difference)
3. krb5-1.21.2

—
Michal

=?utf-8?Q?Micha=C5=82_K=C5=82eczek?= <michal@kleczek.org> writes:
> On 27 Jan 2024, at 15:43, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> Which FreeBSD version?  Which krb5 package version?
>> Is this x86_64, or something else?

> Right, sorry:

> 1. X86_64
> 2. FreeBSD 13.2 (It is in a TrueNAS Jail if it makes any difference)
> 3. krb5-1.21.2

Hmm.  I made a desultory attempt at replicating this, using
a fully-updated FreeBSD 13.2 image.  I can't find anything wrong,
but it's not clear to me that I duplicated your configuration.

To make sure we're on the same page: do the tests in src/test/kerberos
in our source tree pass on your system?  Read the README there for
caveats, then do

    make check PG_TEST_EXTRA=kerberos

            regards, tom lane