Skip Menu |
 

Date: Tue, 27 Mar 2007 17:06:06 -0700 (Pacific Daylight Time)
From: petesea@bigfoot.com
Subject: Kfw 3.2 alpha and multiple krbcc32s processes for a user
To: kfw-bugs@mit.edu
Download (untitled) / with headers
text/plain 1.6KiB
I posted the question below to the kerberos list on Feb 6 - Subject "KfW
3.1 and multiple krbcc32s.exe processes". I haven't had much opportunity
to dig into it further until now.

I came up with a simple way to test it and found the problem still exists
with KfW 3.2 alpha.

I created a new user (easier to test this way)... then created a
"Scheduled Task" that runs klist as this new user. The task was
configured to run every minute for 5 minutes or so.

It doesn't really matter if "klist" works or not, the goal is simply to
run something that starts krbcc32s.

Each time the scheduled task runs, a new krbcc32s process is created even
if one already exists for the user. The krbcc32s processes never die. I
used "Process Explorer" to monitor the processes which makes it very easy
to see when they are created and by who. Obviously, if you do something
like kinit every couple of hours 24/7 this becomes a problem.

Any chance this could be fixed for the 3.2 release?

On Tue, 6 Feb 2007, Jeffrey Altman wrote:

Show quoted text
> petesea@bigfoot.com wrote:
>
>> I have a user running some batch files as scheduled jobs (aka cron
>> jobs). He's noticed that after a period of time there will be several
>> krbcc32s.exe processes running which never go away.
>>
>> Under what conditions might this happen?
>
> There is one krbcc32s.exe per login session. krbcc32s.exe runs until
> the session ends.
>
>> The batch files run kinit -kt with a keytab/principal, then do what
>> they need to do, then run kdestroy. The NIM is never running (as far
>> as I know).
>
> krbcc32s.exe is the credential cache server. It runs when krb5_32.dll
> is loaded if it is not already started in the current session.
Date: Wed, 28 Mar 2007 16:55:54 -0400
From: Jeffrey Altman <jaltman@mit.edu>
To: rt-kfw@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #5494] Kfw 3.2 alpha and multiple krbcc32s processes for a user
RT-Send-Cc:
Download (untitled) / with headers
text/plain 2.1KiB
petesea@bigfoot.com via RT wrote:
Show quoted text
> I posted the question below to the kerberos list on Feb 6 - Subject "KfW
> 3.1 and multiple krbcc32s.exe processes". I haven't had much opportunity
> to dig into it further until now.
>
> I came up with a simple way to test it and found the problem still exists
> with KfW 3.2 alpha.
>
> I created a new user (easier to test this way)... then created a
> "Scheduled Task" that runs klist as this new user. The task was
> configured to run every minute for 5 minutes or so.
>
> It doesn't really matter if "klist" works or not, the goal is simply to
> run something that starts krbcc32s.
>
> Each time the scheduled task runs, a new krbcc32s process is created even
> if one already exists for the user. The krbcc32s processes never die. I
> used "Process Explorer" to monitor the processes which makes it very easy
> to see when they are created and by who. Obviously, if you do something
> like kinit every couple of hours 24/7 this becomes a problem.
>
> Any chance this could be fixed for the 3.2 release?

Each time that Scheduled Task runs a process for a user that is not
logged into the machine it performs a non-interactive logon which in
turn produces a new logon session. The end result is that if you
execute a Kerberos operation that queries the credential cache, a new
instance of krbcc32s.exe will be started. A new krbcc32s.exe is
required because the RPC security binding is per-session.

The reason that krbcc32s.exe does not terminate is that there is no
trigger to tell it to exit. Unlike an interactive logon session, a
non-interactive session does not logoff. It stays around until all of
the processes executing within the session terminate. What is really
sad is that the Scheduled Tasks "terminate task after X time" option
only kills the immediately executed process and does not close the session.

There are only two possible solutions I can think of.

(1) Provide a command that can be used to instruct the krbcc32s.exe
process to exit that can be added to scripts executed as scheduled tasks.

(2) Stop using logon session specific credential caches and move to a
monolithic per machine model.

Jeffrey Altman
As discussed privately, executing a kerberos operation within a logon
session starts a copy of krbcc32s.exe. For a non-interactive logon
session, the script that is executed should issue the command "krbcc32s
-k" before terminating in order to shutdown the credential cache service
within its logon session. Otherwise, the logon session will never
terminate and the krbcc32s.exe will run forever.