Re: KTH Kerberos 4 won't compile

From: Tim Haynes (usenet@stirfried.vegetable.org.uk)
Date: 01/04/03 

From: Tim Haynes <usenet@stirfried.vegetable.org.uk>
Date: Sat, 04 Jan 2003 18:35:48 +0000

"Nico Kadel-Garcia" <nkadel@bellatlantic.net> writes:

>> I hope you're not building stuff as root.
>
> Umm. There is one way in which building stuff as root is more reliable:
> the use of LD_LIBRARY_PATH is blocked for the root user, and it can
> sometimes cause problems when configuring/compiling as a non-root user
> with such a path set, then trying to run the binaries as root.

Hmmmmmm. If my LD_LIBRARY_PATH were that out of my control and caused that
much of a problem, I'd probably take me out and shoot myself.

More to the point, these days there have been too many trojanned source
packages to trust building as root without a decent sandbox.

> For example, if a Kerberos "make" fails, it is forced to start *all over*
> by a timestamp they set. You can't just correct the one file and
> continue, the entire thing has to be recompiled.

FFS. This ranks right up alongside

     shit.o: shit.c someheaderfile.h Makefile #idiocy here
                gcc -c ....

then?

> And if you don't happen to use a FQHN for your `hostname` setting, it
> fails right at the end of the compilation. Their response to this issue?
> "You should have a FQHN."

Fuck that with a bargepole! I've got far better things to be doing than
screwing around looking at `hostname.some.domain login>' for the rest of my
miserable existence. And where the flip is it decreed that a host must
belong to but one domain, anyway? Grrrrrrr.

[snip]
>> You have a (gross) mismatch of ndbm requirement & provision; read
>> through the ndbm.h header file for the function definition in question,
>> see how many arguments & what types/names they are. Compare this with
>> the crud that kerberos is flinging at it and weep. :8] Resolve it any
>> which way you like: either up/downgrade ndbm, or kerberos, or fix the
>> function call and prepare to encounter many similar problems elsewhere
>> (and submit a diff to the authors for posterity once you get it
>> working).
>
> Good luck! My previous encounters with the Kerberos authors and this kind
> of bug has been "do it Our Way because Our Way is the Right Way". It's
> made me want to go into the SIPB office at MIT where they hung out and
> use a very large magnet on all their disks.....

Hmmm. Maybe I could use a central login-manager on the LAN here. Not going
to try nis or kerberos (although the latter has a little appeal), so maybe
it's ldap time?

~Tim 

-- 
zsh % perl -ce 'more or less'               |piglet@stirfried.vegetable.org.uk
-e syntax OK                                |http://spodzone.org.uk/

Relevant Pages

  • Security Weaknesses of OS X
    ... installed applications which would then provide access to the root ... If you don't set a password for the root user, ... administrator password would be required to make changes to a specific ... This would prevent malware from ...
    (comp.sys.mac.system)
  • Re: suEXEC
    ... Running processes as "root" should be a last resort, ... so here i want to use root user. ... echo Content-type: text/html ... first virtual hosting is showing username cgiuser but second virtual ...
    (RedHat)
  • Re: CUPS admin
    ... >> jobs - need to go to CUPS web admin interface and>> click the ... you should use sudo does not alter the fact that a root user exists. ...
    (comp.os.linux.setup)
  • Re: Prevent Root access from database
    ... > Weve got a new security drive underway in our organisation, ... > server should be prevented from the root user. ... > users getting into the database to see the data ?. ...
    (comp.databases.oracle.server)
  • Re: su in C
    ... > order to "su to root" to perform some task. ... ie how do i perform the actual su functionality? ... then have the root user chown/chmod the program to be a "setuid root" program ... for the root user, cryptto encrypt the entered plaintext password, and ...
    (comp.os.linux.development.apps)