search

rocker-org / rocker

R configurations for Docker
https://rocker-project.org
GNU General Public License v2.0
1.45k stars 273 forks source link

libk5crypto in r-base image doesn't work: "Random number generator could not be seeded while getting initial credentials" #502

Closed yrro closed 1 year ago

yrro commented 1 year ago

When using docker.io/library/r-base:latest + the Microsoft ODBC Driver 17 for SQL Server to authenticate to an MS SQL server using (Kerberos) integrated authentication, I get this error:

[HY000] [unixODBC][Microsoft][ODBC Driver 17 for SQL Server]SSPI Provider: No credentials were supplied, or the credentials were unavailable or inaccessible. Random number generator could not be seeded (458752) (SQLDriverConnect)'

From a new container, apt update && apt -y install krb5-user will install the tools needed to reproduce; following that:

root@02d8b31fc563:/# kinit user@EXAMPLE.COM
kinit: Random number generator could not be seeded while getting initial credentials

The error message comes from libk5crypto.so.3. Checking the version of the libk5crypto3 package I can see that it (1.19.something) is quite old compared to the current version in testing. Upgrading it (apt install libk5crypto3) pulls in the current version, which fixes the problem, giving the expected:

root@02d8b31fc563:/# kinit user@EXAMPLE.COM
kinit: Cannot find KDC for realm "EXAMPLE.COM" while getting initial credentials

This will be fixed when r-base:latest is rebuilt against a current snapshot of Debian testing. Until then I hope this bug report saves some time for anyone else who is looking at the above error message and wondering what it means. :)

yrro commented 1 year ago

Uuh sorry I hit enter too soon. I'm editing the bug report above to include the actual bug report... please check back soon :)

eddelbuettel commented 1 year ago

(Note that you can edit via the ... menu as well as delete so just alter the first box and remove the second)

Does the RNG maybe need elevated rights from the host / docker? Does not sound like something specific to Rocker ...

yrro commented 1 year ago

No it's purely an outdated package - it'll be fixed when you do a new build from a current Debian testing snapshot. But it's been a while since the last one & debugging this was fairly horrendous so the bug report is worthwhile in case anyone else is scratching their head looking at the error message.

eddelbuettel commented 1 year ago

Ok, so you too can do apt update -qq && apt upgrade -y and we're done here. So I think I can close this.

yrro commented 1 year ago

FYI apt upgrade is currently failing with:

Selecting previously unselected package usrmerge.
(Reading database ... 18539 files and directories currently installed.)
Preparing to unpack .../archives/usrmerge_30_all.deb ...
Unpacking usrmerge (30) ...
Setting up usrmerge (30) ...

Warning: overlayfs detected, /usr/lib/usrmerge/convert-usrmerge will not
be run automatically. See #1008202 for details.

If this is a container then it can be converted by unpacking the image,
entering it with chroot(8), installling usrmerge and then repacking the
image again.

E: usrmerge failed.
dpkg: error processing package usrmerge (--configure):
 installed usrmerge package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 usrmerge
E: Sub-process /usr/bin/dpkg returned an error code (1)

A targetted upgrade (apt install libk5crypto3) avoids running into this problem.

eddelbuettel commented 1 year ago

Strange. I literally minutes ago built a local container off my usual starting point, r-base. And I did this in the first two lines:

FROM r-base

RUN apt-get update && apt-get install -y -t unstable --no-install-recommends \
yrro commented 1 year ago

Looks like you don't apt upgrade before installing stuff?

I think this is happening because init-system-helpers on testing now Depends on usrmerge | usr-is-merged. The current debian:testing image has usr-is-merged installed, so upgrades don't pull in usrmerge. But r-base:latest does not currently have usr-is-merged, so upgrades pull in usrmerge which fails because (I guess) it's not supposed to be used inside a container.

eddelbuettel commented 1 year ago

Good point and catch. Must have skipped that in a rush. I usually do ...

The usrmerge transition is very new. Debian unstable something has to live up to its name, I have found these moments to be rare but it can happen.