NetBSD Problem Report #60320

From www@netbsd.org  Tue Jun  9 22:36:20 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 392911A923A
	for <gnats-bugs@gnats.NetBSD.org>; Tue,  9 Jun 2026 22:36:20 +0000 (UTC)
Message-Id: <20260609223619.416661A923B@mollari.NetBSD.org>
Date: Tue,  9 Jun 2026 22:36:19 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: libsaslc: gssapi mech should support loading keytabs
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60320
>Category:       lib
>Synopsis:       libsaslc: gssapi mech should support loading keytabs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jun 09 22:40:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11
>Organization:
The NetSASLC Credentials, Inc.
>Environment:
>Description:

	libsaslc(3) can be used as a gssapi/krb5 client with a
	credential cache, as shown in the man page
	<https://man.netbsd.org/NetBSD-11.x-BRANCH/libsaslc.3#GSSAPI%20AND%20KERBEROS>:

>    Here we have assumed the submission port is the port the server is lis-
>    tening to.  Finally, as root, run the command
>
>          su -m postfix -c kinit
>
>    to obtain a ticket for the postfix user with the postfix credential and
>    you should be good to go!

	This is a little silly for a service daemon that happens to be
	running as a client.  Typical practice with Kerberos is for
	service daemons to have their own long-term keys stored in a
	keytab file, as the server side of the same example does.

	It should be possible for the libsaslc client to start with a
	keytab too, instead of having to run `su -m postfix -c kinit'
	every time you want to make postfix relay mail.  If this can be
	done with the KRB5_KTNAME environment variable, it would be
	nice if the example demonstrated that.  If not, it would be
	nice if there were a way to do this, e.g. with
	saslc_sess_setprop to set a keytab path, maybe using libkrb5 or
	using the gssapi credential store extensions
	(https://k5wiki.kerberos.org/wiki/Projects/Credential_Store_extensions,
	supported in not-yet-released heimdal too).

	Also: the man page example doesn't actually work; postfix fails
	with, e.g.:

> Jun  8 19:25:31 singbulli postfix/smtp[22014]: fatal: specify a password table via the `smtp_sasl_password_maps' configuration parameter

	But it is sufficient to set, say:

		smtpd_sasl_password_maps = static:postfix

	Other minor issues in the man page:

	1. kstash is not recommended these days -- needless UI
	   complexity for defence against threat model better handled
	   by disk encryption

	2. various `kadmin add' arguments can, and for batch scripts
	   should, be abbreviated to `--use-defaults'

	3. root-owned /etc/krb5.keytab shouldn't be necessary for the
	   server side; postfix-owned file under /var/spool/postfix or
	   /var/db/postfix might make the configuration tidier

>How-To-Repeat:

	read libsaslc(3) man page
	try to set up postfix as client with gssapi/krb5

>Fix:

	Yes, please!

Home	PR Database Search