symbol krb5_get_init_creds_opt_alloc

Latest response

Hello ,

I'm getting errors as follows:
[itsuser@specapacdev2 ~]$ sudo net ads testjoin
net: relocation error: net: symbol krb5_get_init_creds_opt_alloc, version krb5_3 _MIT not defined in file libkrb5.so.3 with link time reference

Also getting similar for klist commands.

This is a server I have taken over and it seems like these errors are to do with Active Directory/Kerberos.

The time on the server matches my Windows machines and NTP looks to be configured correctly.

/etc/sysconfig/selinux set to SELINUX=disabled although it was set to permissive before I changed it and krb-libs have been updated.

/etc/krb5.conf, /etc/sssd/sssd.conf and /etc/samba/smb.conf look to be configured correctly compared to another server I have setup.

Any suggestions?

Sl
Log in to join the conversation

Responses

Radek Bíba's picture Red Hat Guru 1517 points
12 October 2015 7:39 AM

Hello Suzanne,

I'd say your installation of Kerberos is broken. Could you check which version is installed and verify the package? To do so, run the following commands:

rpm -q krb5-libs
rpm -V krb5-libs

What do they report?

Sl Community Member 30 points
12 October 2015 9:41 AM

Hello Radek,

See the following:
[itsuser@specapacdev2 ~]$ sudo rpm -q krb5-libs
[sudo] password for itsuser:
krb5-libs-1.10.3-42.el6.x86_64
[itsuser@specapacdev2 ~]$ sudo rpm -V krb5-libs
[itsuser@specapacdev2 ~]$ man rpm
[itsuser@specapacdev2 ~]$ sudo rpm -U krb5-libs
error: open of krb5-libs failed: No such file or directory
[itsuser@specapacdev2 ~]$ sudo yum upgrade krb5-libs
Loaded plugins: product-id, refresh-packagekit, rhnplugin, security, subscription-manager
This system is receiving updates from RHN Classic or RHN Satellite.
Setting up Upgrade Process
No Packages marked for Update

I can do an rpm -e on the install and yum install again if you think that is required.

Regards

Radek Bíba's picture Red Hat Guru 1517 points
12 October 2015 9:56 AM

That looks all right, although you could also check this:

strings /lib64/libkrb5.so.3 | egrep 'krb5_get_init_creds_opt_alloc|krb5_3'

...and "yum reinstall krb5-libs" can't hurt, either.

What about the "net" command -- could you please run rpm -q and -V with samba-common as a parameter?

Sl Community Member 30 points
12 October 2015 10:31 AM

Seeing the following:
[itsuser@specapacdev2 ~]$ strings /lib64/libkrb5.so.3 | egrep 'krb5_get_init_creds_opt_alloc|k rb5_3'
krb5_get_init_creds_opt_alloc
krb5_3_MIT
[itsuser@specapacdev2 ~]$ man strings
[itsuser@specapacdev2 ~]$ sudo yum reinstall krb5-libs
[sudo] password for itsuser:
Loaded plugins: product-id, refresh-packagekit, rhnplugin, security, subscription-manager
This system is receiving updates from RHN Classic or RHN Satellite.
Setting up Reinstall Process
Resolving Dependencies
--> Running transaction check
---> Package krb5-libs.x86_64 0:1.10.3-42.el6 will be reinstalled
--> Finished Dependency Resolution

Dependencies Resolved

==============================================================================================

Package Arch Version Repository Size

Reinstalling:
krb5-libs x86_64 1.10.3-42.el6 rhel-x86_64-server-6 769 k

Transaction Summary

Reinstall 1 Package(s)

Total download size: 769 k
Installed size: 2.0 M
Is this ok [y/N]: y
Downloading Packages:
krb5-libs-1.10.3-42.el6.x86_64.rpm | 769 kB 00:00
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : krb5-libs-1.10.3-42.el6.x86_64 1/1
/sbin/ldconfig: /apps/netegrity/siteminder/webagent/bin/libicutest.so.49 is not a symbolic lin k

/sbin/ldconfig: /apps/netegrity/siteminder/webagent/bin/libicutu.so.49 is not a symbolic link

/sbin/ldconfig: /apps/netegrity/siteminder/webagent/bin/libicui18n.so.49 is not a symbolic lin k

/sbin/ldconfig: /apps/netegrity/siteminder/webagent/bin/libicuuc.so.49 is not a symbolic link

/sbin/ldconfig: /apps/netegrity/siteminder/webagent/bin/libicule.so.49 is not a symbolic link

/sbin/ldconfig: /apps/netegrity/siteminder/webagent/bin/libiculx.so.49 is not a symbolic link

/sbin/ldconfig: /apps/netegrity/siteminder/webagent/bin/libicudata.so.49 is not a symbolic lin k

/sbin/ldconfig: /apps/netegrity/siteminder/webagent/bin/libicuio.so.49 is not a symbolic link

Verifying : krb5-libs-1.10.3-42.el6.x86_64 1/1

Installed:
krb5-libs.x86_64 0:1.10.3-42.el6

Complete!
[itsuser@specapacdev2 ~]$ klist
klist: relocation error: klist: symbol krb5_is_config_principal, version krb5_3_MIT not define d in file libkrb5.so.3 with link time reference
[itsuser@specapacdev2 ~]$ sudo net ads testjoin
net: relocation error: net: symbol krb5_get_init_creds_opt_alloc, version krb5_3_MIT not defin ed in file libkrb5.so.3 with link time reference
[itsuser@specapacdev2 ~]$ sudo rpm -q samba-common
samba-common-3.6.23-20.el6.x86_64
[itsuser@specapacdev2 ~]$ sudo rpm -V samba-common

If I look in the affected directory I can see the following and I read elsewhere that perhaps there may be an issue with multiple copies of files. I could create an other directory here and move the files here if you think it could make any difference. I suppose if I was to do this I'd leave the .49.1.2 files:
[itsuser@specapacdev2 ~]$ ls -l /apps/netegrity/siteminder/webagent/bin/libicu*
-rwxrwxr-x. 1 root root 17956356 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicudata.so
-rwxrwxr-x. 1 root root 17956356 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicudata.so.49
-rwxrwxr-x. 1 root root 17956356 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicudata.so.49.1.2
-rwxrwxr-x. 1 root root 2780743 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicui18n.so
-rwxrwxr-x. 1 root root 2780743 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicui18n.so.49
-rwxrwxr-x. 1 root root 2780743 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicui18n.so.49.1.2
-rwxrwxr-x. 1 root root 62951 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicuio.so
-rwxrwxr-x. 1 root root 62951 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicuio.so.49
-rwxrwxr-x. 1 root root 62951 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicuio.so.49.1.2
-rwxrwxr-x. 1 root root 346484 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicule.so
-rwxrwxr-x. 1 root root 346484 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicule.so.49
-rwxrwxr-x. 1 root root 346484 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicule.so.49.1.2
-rwxrwxr-x. 1 root root 69230 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libiculx.so
-rwxrwxr-x. 1 root root 69230 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libiculx.so.49
-rwxrwxr-x. 1 root root 69230 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libiculx.so.49.1.2
-rwxrwxr-x. 1 root root 82887 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicutest.so
-rwxrwxr-x. 1 root root 82887 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicutest.so.49
-rwxrwxr-x. 1 root root 82887 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicutest.so.49.1.2
-rwxrwxr-x. 1 root root 205319 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicutu.so
-rwxrwxr-x. 1 root root 205319 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicutu.so.49
-rwxrwxr-x. 1 root root 205319 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicutu.so.49.1.2
-rwxrwxr-x. 1 root root 1845696 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicuuc.so
-rwxrwxr-x. 1 root root 1845696 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicuuc.so.49
-rwxrwxr-x. 1 root root 1845696 Feb 3 2015 /apps/netegrity/siteminder/webagent/bin/libicuuc.so.49.1.2
[itsuser@specapacdev2 ~]$ man ldconfig
[itsuser@specapacdev2 ~]$ md5sum -c /apps/netegrity/siteminder/webagent/bin/libicudata.so
md5sum: /apps/netegrity/siteminder/webagent/bin/libicudata.so: no properly formatted MD5 checksum lines found
[itsuser@specapacdev2 ~]$ cd /apps/netegrity/siteminder/webagent/bin/
[itsuser@specapacdev2 bin]$ md5sum libicudata.so
dcee133f73840266cad7e008d1e6be95 libicudata.so
[itsuser@specapacdev2 bin]$ md5sum libicudata.so.49
dcee133f73840266cad7e008d1e6be95 libicudata.so.49

ldconfig looks good as well:
[itsuser@specapacdev2 bin]$ ldconfig -p|grep krb5
libndr-krb5pac.so.0 (libc6,x86-64) => /usr/lib64/libndr-krb5pac.so.0
libkrb5support.so.0 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libkrb5support.so.0
libkrb5support.so.0 (libc6,x86-64) => /lib64/libkrb5support.so.0
libkrb5.so.3 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libkrb5.so.3
libkrb5.so.3 (libc6,x86-64) => /lib64/libkrb5.so.3
libgssapi_krb5.so.2 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libgssapi_krb5.so.2
libgssapi_krb5.so.2 (libc6,x86-64) => /lib64/libgssapi_krb5.so.2
[itsuser@specapacdev2 bin]$ ldconfig -p|grep libicu
libicuuc.so.49 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libicuuc.so.49
libicuuc.so.42 (libc6,x86-64) => /usr/lib64/libicuuc.so.42
libicuuc.so (libc6,x86-64) => /apps/netegrity/siteminder/webagent/lib/libicuuc.so
libicutu.so.49 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libicutu.so.49
libicutu.so.42 (libc6,x86-64) => /usr/lib64/libicutu.so.42
libicutu.so (libc6,x86-64) => /apps/netegrity/siteminder/webagent/lib/libicutu.so
libicutest.so.49 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libicutest.so.49
libicutest.so (libc6,x86-64) => /apps/netegrity/siteminder/webagent/lib/libicutest.so
libiculx.so.49 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libiculx.so.49
libiculx.so.42 (libc6,x86-64) => /usr/lib64/libiculx.so.42
libiculx.so (libc6,x86-64) => /apps/netegrity/siteminder/webagent/lib/libiculx.so
libicule.so.49 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libicule.so.49
libicule.so.42 (libc6,x86-64) => /usr/lib64/libicule.so.42
libicule.so (libc6,x86-64) => /apps/netegrity/siteminder/webagent/lib/libicule.so
libicui18n.so.49 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libicui18n.so.49
libicui18n.so.42 (libc6,x86-64) => /usr/lib64/libicui18n.so.42
libicui18n.so (libc6,x86-64) => /apps/netegrity/siteminder/webagent/lib/libicui18n.so
libicuio.so.49 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libicuio.so.49
libicuio.so.42 (libc6,x86-64) => /usr/lib64/libicuio.so.42
libicuio.so (libc6,x86-64) => /apps/netegrity/siteminder/webagent/lib/libicuio.so
libicudata.so.49 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libicudata.so.49
libicudata.so.42 (libc6,x86-64) => /usr/lib64/libicudata.so.42
libicudata.so (libc6,x86-64) => /apps/netegrity/siteminder/webagent/lib/libicudata.so

Version I am using is as follows:
Linux [machine removed] 2.6.32-573.7.1.el6.x86_64 #1 SMP Thu Sep 10 13:42:16 EDT 2015 x86_64 x86_64 x86_64 GNU/Linux

Red Hat Enterprise Linux Server release 6.7 (Santiago)

Radek Bíba's picture Red Hat Guru 1517 points
12 October 2015 11:40 AM

I think the problem is here:

 libkrb5.so.3 (libc6,x86-64) => /apps/netegrity/siteminder/webagent/bin/libkrb5.so.3

I don't know what netegrity is, but it apparently overrides the path to the Kerberos libraries, and the Shared Object file it provides doesn't contain all that the "net" and "klist" commands need.

I'm not sure if there actually is a way to make "net" and "klist" work without uninstalling netegrity from the affected machine.

Radek Bíba's picture Red Hat Guru 1517 points
12 October 2015 11:54 AM

Just to check whether the overridden path is really used, would you mind running the following commands?

ldd /usr/bin/net | grep krb5
ldd /usr/bin/klist | grep krb5

I see that .so files in /lib64 are used on my test machine.

Sl Community Member 30 points
12 October 2015 1:06 PM

Here you go:
[itsuser@specapacdev2 /]$ ldd /usr/bin/net | grep krb5
libgssapi_krb5.so.2 => /apps/netegrity/siteminder/webagent/bin/libgssapi_krb5.so.2 (0x00007f83a81b9000)
libkrb5.so.3 => /apps/netegrity/siteminder/webagent/bin/libkrb5.so.3 (0x00007f83a8032000)
libkrb5support.so.0 => /apps/netegrity/siteminder/webagent/bin/libkrb5support.so.0 (0x00007f83a5e2b000)
[itsuser@specapacdev2 /]$ ldd /usr/bin/klist | grep krb5
libkrb5.so.3 => /apps/netegrity/siteminder/webagent/bin/libkrb5.so.3 (0x00007f545bd85000)
libkrb5support.so.0 => /apps/netegrity/siteminder/webagent/bin/libkrb5support.so.0 (0x00007f545b952000)
[itsuser@specapacdev2 /]$ sudo yum search netegrity
[sudo] password for itsuser:
Loaded plugins: product-id, refresh-packagekit, rhnplugin, security, subscription-manager
This system is receiving updates from RHN Classic or RHN Satellite.
Warning: No matches found for: netegrity
No Matches found
[itsuser@specapacdev2 /]$ sudo rpm -q netegrity
package netegrity is not installed

Radek Bíba's picture Red Hat Guru 1517 points
12 October 2015 1:18 PM

Thanks. I guess the question is now, do the netegrity files have to be present on the system? Do you know anything about them?

Sl Community Member 30 points
12 October 2015 1:24 PM

I'll have to go talking to other people. Appreciate all your help.

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.