Bugzilla Bug 98848

mit-krb5-1.4.1 breaks Samba 3.0.14a in ADS mode, see bug #98303. Downgrading to
mit-krb5-1.3.6-r2 solves the problem. I know it's a security risk, but the other
option is a system that is *broken*.

Now 1.3.6-r2 disappeared from the portage tree -> no way for people to get their
systems working again.

Reproducible: Always
Steps to Reproduce:
Please see bug #98303
Actual Results:  
Cannot downgrade to get Samba working in ADS mode again.

Expected Results:  
Fix Samba with krb-1.4.1; in the meantime, keep 1.3.6-r2 around.

I'm not sure, but this may have to do with the following MAJOR security breach
in this package -- just resolved today:

http://bugs.gentoo.org/show_bug.cgi?id=98799

Well, for me a non-working system is a more severe breakage than a security
hole
in a network I trust 98%.

I *cannot* run use mit-krb-1.4.1 unless the Samba issue is fixed. This is
*critical* in my production environment.

mit-krb5-1.4.1-r2 does *not* fix the Samba problem!

Grab it from WebCVS and put it into your overlay if you want it...

http://www.gentoo.org/cgi-bin/viewcvs.cgi/app-crypt/mit-krb5/

I managed to get it back from one of my servers that was not synced yet.

Now, I do understand you'd want the new version out ASAP, but if we need to have
samba working with krb, are those of us supposed to find out and do it manually
like I did?

I can't really decide here, but I think pulling the old version completely was
not the best move. Convince me otherwise .-/

BTW: Can no longer build PHP with kerberos support with 1.4.1.

(In reply to comment #6)
> BTW: Can no longer build PHP with kerberos support with 1.4.1.

Quick aside:  I'm having this as well.  I've seen one similar forum thread so
far, but I think the recent upgrade has made it more wide-spread now.

(In reply to comment #6)
> BTW: Can no longer build PHP with kerberos support with 1.4.1.

This is really not much productive to moan here... I don't know if there is a
bug open for the PHP problem; if not, then open a new bug and post the error
messages and whatnot there, please.

Wrt comment #6 and comment #7: does Bug 98842 describe the problem w/ PHP and
new mit-krb5 version? 

Well, it does not build with -kerberos, either. Complains about libcrpyto.
But set that aside, as it is not the main problem here. (Yet :-)

To #9: Yes I guess it does. Looks like what I get.

What didn't work was building with -kerberos in package.use

My fault. Workaround in #98842 is viable.

(In reply to comment #9)
> Wrt comment #6 and comment #7: does Bug 98842 describe the problem w/ PHP and
> new mit-krb5 version? 

Yes, this describes the PHP problem perfectly.  The key error is in the config file:
---------------
/usr/lib/gcc-lib/i686-pc-linux-gnu/3.3.5-20050130/../../../../i686-pc-linux-gnu/bin/ld:
cannot find -lgssapi
collect2: ld returned 1 exit status
---------------

The line:
cannot find -lgssapi

appears to be the key problem (part of the kerberos package).  Removing the
kerberos USE flag from the build compiles the package perfectly for me.  I'll
add to that bug as well.

(In reply to comment #8)
> (In reply to comment #6)
> > BTW: Can no longer build PHP with kerberos support with 1.4.1.
> 
> This is really not much productive to moan here... 

FYI:  I only wanted to quickly let you know that it appears the new package may
be affecting more than this bug here...

Wgi, give me a few hours to sort out samba + mit 1.4.1.  I'm sorry for your
inconvenience (I really am!).  If I'm unable to put a fix out, I'll backport the
security fixes on 1.3.6 and put out 1.3.6-r3 for you.  I'm only asking that you
bear with me for a few hours.

*** This bug has been marked as a duplicate of 98303 ***

Of course. Thanks a lot for the effort!