Thanks for the pointer Brian, see SRU format below:
[Impact]
* Effects of the bug on users
The kdc process leaks memory which means the users will need to restart the service when enough time has passed.
* Justification for backporting the fix to the stable release
The kdc is a long lived process, which means this leak will eventually be hit by anyone. I would not regard the current package as "stable".
* Modify /etc/krb5.conf so you use the same machine for AS-REQ:
---
[realms]
YOUR.REALM = {
kdc = your-local-machine.tld
}
---
* Add a user with name "test" and password "test"
---
# kadmin -l --use-defaults test
<email address hidden>'s Password:
Verify password - <email address hidden>'s Password:
#
---
* Note how much RAM is currently being used by the kdc process:
---
# ps auxww | grep kdc | grep -v grep
root 832 0.0 0.1 79948 2768 ? S 09:22 0:00 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---
* Perform a bunch of requests against it:
---
# for request in {1..20000}; do echo test | kinit --password-file=STDIN <email address hidden>; done
---
* Note how much RAM is used after the test has been completed:
# ps auxww | grep kdc | grep -v grep
root 832 2.1 0.4 85660 9104 ? S 09:22 0:27 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---
* Install the new packages
* Reboot the machine
* Get a fresh RAM measurement:
---
# ps auxww | grep kdc | grep -v grep
root 864 0.0 0.1 79948 2764 ? S 11:01 0:00 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---
* Run test again
---
# for request in {1..20000}; do echo test | kinit --password-file=STDIN <email address hidden>; done
---
* Note that much less memory is used now:
---
# ps auxww | grep kdc | grep -v grep
root 864 1.8 0.1 79948 3468 ? S 11:01 0:27 /usr/lib/heimdal-servers/kdc --config-file=/etc/heimdal-kdc/kdc.conf
---
Thanks for the pointer Brian, see SRU format below:
[Impact]
* Effects of the bug on users
The kdc process leaks memory which means the users will need to restart the service when enough time has passed.
* Justification for backporting the fix to the stable release
The kdc is a long lived process, which means this leak will eventually be hit by anyone. I would not regard the current package as "stable".
* Explanation of how the upload fixes this bug /github. com/heimdal/ heimdal/ issues/ 93
https:/
[Test Case]
* Install heimdal-kdc package
* Modify /etc/krb5.conf so you use the same machine for AS-REQ: machine. tld
---
[realms]
YOUR.REALM = {
kdc = your-local-
}
---
* Add a user with name "test" and password "test"
---
# kadmin -l --use-defaults test
<email address hidden>'s Password:
Verify password - <email address hidden>'s Password:
#
---
* Note how much RAM is currently being used by the kdc process: heimdal- servers/ kdc --config- file=/etc/ heimdal- kdc/kdc. conf
---
# ps auxww | grep kdc | grep -v grep
root 832 0.0 0.1 79948 2768 ? S 09:22 0:00 /usr/lib/
---
* Perform a bunch of requests against it: file=STDIN <email address hidden>; done
---
# for request in {1..20000}; do echo test | kinit --password-
---
* Note how much RAM is used after the test has been completed: heimdal- servers/ kdc --config- file=/etc/ heimdal- kdc/kdc. conf
# ps auxww | grep kdc | grep -v grep
root 832 2.1 0.4 85660 9104 ? S 09:22 0:27 /usr/lib/
---
* Install the new packages
* Reboot the machine
* Get a fresh RAM measurement: heimdal- servers/ kdc --config- file=/etc/ heimdal- kdc/kdc. conf
---
# ps auxww | grep kdc | grep -v grep
root 864 0.0 0.1 79948 2764 ? S 11:01 0:00 /usr/lib/
---
* Run test again file=STDIN <email address hidden>; done
---
# for request in {1..20000}; do echo test | kinit --password-
---
* Note that much less memory is used now: heimdal- servers/ kdc --config- file=/etc/ heimdal- kdc/kdc. conf
---
# ps auxww | grep kdc | grep -v grep
root 864 1.8 0.1 79948 3468 ? S 11:01 0:27 /usr/lib/
---