Skip to content

Commit

Permalink
Reformat KRB5_TRACE.md to witihn 72 columns
Browse files Browse the repository at this point in the history
Signed-off-by: Simo Sorce <simo@redhat.com>
  • Loading branch information
simo5 committed May 27, 2022
1 parent 88bfaa1 commit b1e5159
Showing 1 changed file with 25 additions and 10 deletions.
35 changes: 25 additions & 10 deletions docs/KRB5_TRACE.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,21 +2,36 @@

Enabling `KRB5_TRACE` output as described in `# man gssproxy.conf`:

**At level 3 and above, KRB5_TRACE output is logged. If KRB5_TRACE was already set in the execution environment, trace output is sent to its value instead.**

can be done either by including `KRB5_TRACE=/path/to/location` when executing gssproxy at the command line or by including a location within a drop file loaded by systemd. Systemd uses unix sockets to redirect outputs to the journal, and this means `/dev/stderr` ends up pointing to a name that cannot be used as a path to open the stderr descriptor. A drop file is necessary to record `KRB5_TRACE` information as gssproxy directs `KRB5_TRACE` to `/dev/stderr` by default.

The output can be directed to any location, but gssproxy only has write access to `/var/lib/gssproxy` by default. This means that for a host system using SELinux either a custom module policy will need to be created or SELinux will need to be put into permissive mode.

As setting `KRB5_TRACE` output is not designed to be continually logged nor treated as traditional log output, it is recommended to direct the trace output to `/var/lib/gssproxy`.

- Increase gssproxy debugging so that `KRB5_TRACE` information is logged as described in `# man gssproxy.conf`.
**At level 3 and above, KRB5_TRACE output is logged. If KRB5_TRACE was
already set in the execution environment, trace output is sent to its
value instead.**

can be done either by including `KRB5_TRACE=/path/to/location` when
executing gssproxy at the command line or by including a location within
a drop file loaded by systemd. Systemd uses unix sockets to redirect
outputs to the journal, and this means `/dev/stderr` ends up pointing to
a name that cannot be used as a path to open the stderr descriptor.
A drop file is necessary to record `KRB5_TRACE` information as gssproxy
directs `KRB5_TRACE` to `/dev/stderr` by default.

The output can be directed to any location, but gssproxy only has write
access to `/var/lib/gssproxy` by default. This means that for a host
system using SELinux either a custom module policy will need to be
created or SELinux will need to be put into permissive mode.

As setting `KRB5_TRACE` output is not designed to be continually logged
nor treated as traditional log output, it is recommended to direct the
trace output to `/var/lib/gssproxy`.

- Increase gssproxy debugging so that `KRB5_TRACE` information is logged
as described in `# man gssproxy.conf`.

~~~~
# echo ' debug_level = 3' >> /etc/gssproxy/gssproxy.conf
~~~~

- Create a drop file for gssproxy to log `KRB5_TRACE` output to a file under `/var/lib/gssproxy`
- Create a drop file for gssproxy to log `KRB5_TRACE` output to a file
under `/var/lib/gssproxy`

~~~~
# mkdir /etc/systemd/system/gssproxy.service.d
Expand Down

0 comments on commit b1e5159

Please sign in to comment.