External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 13:45:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

daemon: Avoid 'Could not find keytab file' in syslog

Browse Source 
On F17 at least, every time libvirtd starts we get this in syslog:

libvirtd: Could not find keytab file: /etc/libvirt/krb5.tab: No such file or directory

This comes from cyrus-sasl, and happens regardless of whether the
gssapi plugin is requested, which is what actually uses
/etc/libvirt/krb5.tab.

While cyrus-sasl shouldn't complain, we can easily make it shut up by
commenting out the keytab value by default.

Also update the keytab comment to the more modern one from qemu's
sasl config file.
This commit is contained in:
Cole Robinson 2012-10-20 14:10:03 -04:00
parent 6f8a8b30c9
commit fe772f24a6
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
daemon/libvirtd.sasl
View File

@ -18,9 +18,12 @@ mech_list: digest-md5
# qemu+tcp://hostname/system?auth=sasl.gssapi # qemu+tcp://hostname/system?auth=sasl.gssapi
#mech_list: digest-md5 gssapi #mech_list: digest-md5 gssapi
# MIT kerberos ignores this option & needs KRB5_KTNAME env var. # Some older builds of MIT kerberos on Linux ignore this option &
# May be useful for other non-Linux OS though.... # instead need KRB5_KTNAME env var.
keytab: /etc/libvirt/krb5.tab # For modern Linux, and other OS, this should be sufficient
#
# There is no default value here, uncomment if you need this
#keytab: /etc/libvirt/krb5.tab
# If using digest-md5 for username/passwds, then this is the file # If using digest-md5 for username/passwds, then this is the file
# containing the passwds. Use 'saslpasswd2 -a libvirt [username]' # containing the passwds. Use 'saslpasswd2 -a libvirt [username]'

3
docs/auth.html.in
View File

@ -233,7 +233,8 @@ The SASL mechanism configured by default is DIGEST-MD5, which provides a basic
username+password style authentication. To enable Kerberos single-sign-on instead, username+password style authentication. To enable Kerberos single-sign-on instead,
the libvirt SASL configuration file must be changed. This is <code>/etc/sasl2/libvirt.conf</code>. the libvirt SASL configuration file must be changed. This is <code>/etc/sasl2/libvirt.conf</code>.
The <code>mech_list</code> parameter must first be changed to <code>gssapi</code> The <code>mech_list</code> parameter must first be changed to <code>gssapi</code>
instead of the default <code>digest-md5</code>. If SASL is enabled on the UNIX instead of the default <code>digest-md5</code>, and keytab should be set to
<code>/etc/libvirt/krb5.tab</code> . If SASL is enabled on the UNIX
and/or TLS sockets, Kerberos will also be used for them. Like DIGEST-MD5, the Kerberos and/or TLS sockets, Kerberos will also be used for them. Like DIGEST-MD5, the Kerberos
mechanism provides data encryption of the session. mechanism provides data encryption of the session.
</p> </p>