|
2 | 2 |
|
3 | 3 | Enabling `KRB5_TRACE` output as described in `# man gssproxy.conf`:
|
4 | 4 |
|
5 |
| -**At level 3 and above, KRB5_TRACE output is logged. If KRB5_TRACE was already set in the execution environment, trace output is sent to its value instead.** |
6 |
| - |
7 |
| -can be done either by including `KRB5_TRACE=/path/to/location` when executing gssproxy at the command line or by including a location within a drop file loaded by systemd. Systemd uses unix sockets to redirect outputs to the journal, and this means `/dev/stderr` ends up pointing to a name that cannot be used as a path to open the stderr descriptor. A drop file is necessary to record `KRB5_TRACE` information as gssproxy directs `KRB5_TRACE` to `/dev/stderr` by default. |
8 |
| - |
9 |
| -The output can be directed to any location, but gssproxy only has write access to `/var/lib/gssproxy` by default. This means that for a host system using SELinux either a custom module policy will need to be created or SELinux will need to be put into permissive mode. |
10 |
| - |
11 |
| -As setting `KRB5_TRACE` output is not designed to be continually logged nor treated as traditional log output, it is recommended to direct the trace output to `/var/lib/gssproxy`. |
12 |
| - |
13 |
| -- Increase gssproxy debugging so that `KRB5_TRACE` information is logged as described in `# man gssproxy.conf`. |
| 5 | +**At level 3 and above, KRB5_TRACE output is logged. If KRB5_TRACE was |
| 6 | +already set in the execution environment, trace output is sent to its |
| 7 | +value instead.** |
| 8 | + |
| 9 | +can be done either by including `KRB5_TRACE=/path/to/location` when |
| 10 | +executing gssproxy at the command line or by including a location within |
| 11 | +a drop file loaded by systemd. Systemd uses unix sockets to redirect |
| 12 | +outputs to the journal, and this means `/dev/stderr` ends up pointing to |
| 13 | +a name that cannot be used as a path to open the stderr descriptor. |
| 14 | +A drop file is necessary to record `KRB5_TRACE` information as gssproxy |
| 15 | +directs `KRB5_TRACE` to `/dev/stderr` by default. |
| 16 | + |
| 17 | +The output can be directed to any location, but gssproxy only has write |
| 18 | +access to `/var/lib/gssproxy` by default. This means that for a host |
| 19 | +system using SELinux either a custom module policy will need to be |
| 20 | +created or SELinux will need to be put into permissive mode. |
| 21 | + |
| 22 | +As setting `KRB5_TRACE` output is not designed to be continually logged |
| 23 | +nor treated as traditional log output, it is recommended to direct the |
| 24 | +trace output to `/var/lib/gssproxy`. |
| 25 | + |
| 26 | +- Increase gssproxy debugging so that `KRB5_TRACE` information is logged |
| 27 | +as described in `# man gssproxy.conf`. |
14 | 28 |
|
15 | 29 | ~~~~
|
16 | 30 | # echo ' debug_level = 3' >> /etc/gssproxy/gssproxy.conf
|
17 | 31 | ~~~~
|
18 | 32 |
|
19 |
| - - Create a drop file for gssproxy to log `KRB5_TRACE` output to a file under `/var/lib/gssproxy` |
| 33 | + - Create a drop file for gssproxy to log `KRB5_TRACE` output to a file |
| 34 | +under `/var/lib/gssproxy` |
20 | 35 |
|
21 | 36 | ~~~~
|
22 | 37 | # mkdir /etc/systemd/system/gssproxy.service.d
|
|
0 commit comments