[users@httpd] Problem report: ldap / apache 2.0.54: child process crashes after failed authentication

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi, 

We encounter a problem with an apache server in our system, when 
failing authentication with an Active Directory server.

Environment:
Suse linux ( kernel: vmlinuz-2.6.5-7.97-bigsmp )
apache 2.0.54, one patch applied ( attached )
openldap2-2.2.6-37.rpm
( integrated with subversion 1.2.0 )
integrated with Active Directory

Description:
Apache is providing DAV & authentication services in our subversion
setup. For authentication, an external Active Directory is queried. 
This runs very well, except some random crashes as described here.

Problem is, that at certain moments in time an httpd process will
crash: child pid 19732 exit signal Segmentation fault (11)

The way to reproduce it:
1. With a webbrowser, access a file that needs authentication ( in our
   case, in the subversion repository )
2. Provide a not-existing user and password
3. Apache will lookup the user on the AD server, but this will fail.
   ( normally ), asking the user again for user & password.   
4. Do another request ( user & password you type is not important here )
5. The process handling request of step 1 will crash. 

This problem doesn't happen very often, a few times a day for 50 users, 
but has a lot of impact, since it can happen on a long-running commit
to the subversion repository.

I've searched in bug reports and mailing lists, but didn't find anything
that resembled this problem. It seems to be related to freeing up 
resources?

If anybody has a patch, or a way to workaround this problem, please let 
me know.

I see that more of these types of problem reports exist, and people are 
Urged to wait for apache 2.1, which is now in beta. Can anyone tell me 
when it is supposed to be released?

regards,

Lieven.

Extract from the error.log file:
--------------------------------
[Thu Jun 23 16:19:35 2005] [warn] [client 10.102.65.39] [10137]
auth_ldap authenticate: 
   user govaerl authentication failed; URI /svn/test/trunk/test.txt 
   [ldap_simple_bind_s() to check user credentials failed][Invalid
credentials]
[Thu Jun 23 16:19:35 2005] [warn] [client 10.102.65.39] [9168] auth_ldap
authenticate: 
   user govaerl authentication failed; URI /svn/test/trunk/test.txt 
   [ldap_simple_bind_s() to check user credentials failed][Invalid
credentials]
[Thu Jun 23 16:19:35 2005] [notice] child pid 10137 exit signal
Segmentation fault (11)
[Thu Jun 23 16:21:04 2005] [warn] [client 10.102.65.39] [19732]
auth_ldap authenticate: 
   user govaerl authentication failed; URI /svn/test/trunk/test.txt 
   [ldap_simple_bind_s() to check user credentials failed][Invalid
credentials]
[Thu Jun 23 16:21:04 2005] [warn] [client 10.102.65.39] [19733]
auth_ldap authenticate: 
   user govaerl authentication failed; URI /svn/test/trunk/test.txt 
   [ldap_simple_bind_s() to check user credentials failed][Invalid
credentials]
[Thu Jun 23 16:21:04 2005] [warn] [client 10.102.65.39] [19733]
auth_ldap authenticate: 
   user govaerl authentication failed; URI /svn/test/trunk/test.txt 
   [ldap_simple_bind_s() to check user credentials failed][Invalid
credentials]
[Thu Jun 23 16:21:04 2005] [notice] child pid 19732 exit signal
Segmentation fault (11)

Extract from httpd.conf:
------------------------
LoadModule dav_svn_module     modules/mod_dav_svn.so
LoadModule authz_svn_module   modules/mod_authz_svn.so
<Location /svn>
  DAV svn
  SVNParentPath /test/repos

  # access control policy
  AuthzSVNAccessFile /test/svnaccess.conf

  # try anonymous access first, resort to real authentication if
necessary
  Satisfy Any
  Require valid-user

  # LDAP authentication
  AuthType Basic   
  AuthName "Subversion Repository"
  AuthLDAPEnabled on
  AuthLDAPURL "XXXXXXXXXXXXXXXX"

  AuthLDAPAuthoritative on
  AuthLDAPBindDN "XXXXXXXXXXXXXX"
  AuthLDAPBindPassword xxxxxxxxxxx
  Require valid-user 
</Location> 




STRICTLY PERSONAL AND CONFIDENTIAL
This message may contain confidential and proprietary material for the sole use of the intended recipient. Any review or distribution by others is strictly prohibited. If you are not the intended recipient please contact the sender and delete all copies.

Dit bericht is enkel bestemd voor de aangeduide ontvangers en kan vertrouwelijke informatie bevatten. Als u niet de ontvanger bent, dan mag u de inhoud van dit bericht niet bekendmaken noch kopiëren. Als u dit bericht per vergissing ontvangen heeft, gelieve er de afzender of De Post onmiddellijk van op de hoogte te brengen en het bericht vervolgens te verwijderen.

Ce message est uniquement destiné aux destinataires indiqués et peut contenir des informations confidentielles. Si vous n'êtes pas le destinataire, vous ne devez pas révéler le contenu de ce message ou en prendre copie. Si vous avez reçu ce message par erreur, veuillez en informer l'expéditeur, ou La Poste immédiatement, avant de le supprimer.
Index: util_ldap.c
===================================================================
--- util_ldap.c (revision 165194)
+++ util_ldap.c (working copy)
@@ -241,6 +241,8 @@
     int result = 0;
     int failures = 0;
     int version  = LDAP_VERSION3;
+    int rc = LDAP_SUCCESS;
+    struct timeval timeOut = {10,0};    /* 10 second connection timeout */

     util_ldap_state_t *st = (util_ldap_state_t *)ap_get_module_config(
                                 r->server->module_config, &ldap_module); @@ -317,6 +319,19 @@
         /* always default to LDAP V3 */
         ldap_set_option(ldc->ldap, LDAP_OPT_PROTOCOL_VERSION, &version);

+#ifdef LDAP_OPT_NETWORK_TIMEOUT
+        if (st->connectionTimeout > 0) {
+            timeOut.tv_sec = st->connectionTimeout;
+        }
+
+        if (st->connectionTimeout >= 0) {
+            rc = ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, (void *)&timeOut);
+            if (APR_SUCCESS != rc) {
+                ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
+                                 "LDAP: Could not set the connection timeout" );
+            }
+        }
+#endif
     }


@@ -1405,7 +1420,6 @@

     void *data;
     const char *userdata_key = "util_ldap_init";
-    struct timeval timeOut = {10,0};    /* 10 second connection timeout */

     /* util_ldap_post_config() will be called twice. Don't bother
      * going through all of the initialization on the first call @@ -1630,20 +1644,6 @@
                          "LDAP: SSL support unavailable" );
     }

-#ifdef LDAP_OPT_NETWORK_TIMEOUT
-    if (st->connectionTimeout > 0) {
-        timeOut.tv_sec = st->connectionTimeout;
-    }
-
-    if (st->connectionTimeout >= 0) {
-        rc = ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, (void *)&timeOut);
-        if (APR_SUCCESS != rc) {
-            ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
-                             "LDAP: Could not set the connection timeout" );
-        }
-    }
-#endif
-
     return(OK);
 }
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
   "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx

[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux