search

Evengard / cntlm

PLEASE NOTE THAT THIS FORK IS NOT MAINTAINED! For the maintained fork please refer to https://github.com/versat/cntlm. Cntlm is an NTLM / NTLM Session Response / NTLMv2 authenticating HTTP proxy intended to help you break free from the chains of Microsoft proprietary world. More info on http://cntlm.sourceforge.net/ website. THIS VERSION SUPPORTS SSPI, WHICH ALLOWS USERS WITH SMARTCARD AUTHENTICATION TO USE IT ON WINDOWS BOXES!
GNU General Public License v2.0
129 stars 46 forks source link

CNTLM fails after reboot on newer Linux distributions #11

Open jongiddy opened 8 years ago

jongiddy commented 8 years ago

On newer Linux distributions, /var/run links to /run which is a tmpfs directory cleared on each restart. This means that the /var/run/cntlm is deleted on reboot.

When the machine restarts, CNTLM first changes to the cntlm user, and then tries to create the pid file in this directory. Since the directory no longer exists, and /run is only writable by root, this fails.

The simplest solution would be for the daemon to write the pid-file as root, before changing to the non-privileged account.

A workaround is to modify /etc/sysconfig/cntlmd to point PIDFILE to a different location (e.g. PIDFILE="/tmp/cntlmd.pid").

jongiddy commented 8 years ago

In addition, the DEB and RPM packages set /var/run/cntlm as the cntlm user home directory, so it is probably a good idea to run usermod --home /home/cntlm --move-home cntlm to move the home directory.

jongiddy commented 7 years ago

Another fix is to re-create the directory structure before starting CNTLM.

For CentOS 7, see https://www.centos.org/forums/viewtopic.php?p=230529#p230529

pantaoran commented 6 years ago

Another fix is to re-create the directory structure before starting CNTLM.

Wouldn't that need to be arranged in the systemd service definition so that the service can still successfully start after boot? It sounds unnecessarily complicated.

This whole package seems to be a mess and basically broken on modern Linux...?

sschuberth commented 4 years ago

Wouldn't that need to be arranged in the systemd service definition so that the service can still successfully start after boot?

Indeed. I've done that by creating /usr/lib/tmpfiles.d/cntlm.conf with the following content:

d /run/cntlm 0775 root cntlm -