FreeBSD - Connection error after authentication when running in Jail

[SoniDIFF]

I've setup a Netatalk server on my FreeBSD system inside a jail. I managed to configure networking and everything looks to work fine on that part, but for some reason I can't login with my user.

I tried using different UAMs but only guest login allowed me to show available volumes and mount them. Trying with DHX2 and clear text just fail with connection error and I can't figure out anything from verbose logs, connection just stops somewhere during authentication.

I though that something may be wrong with my user or PAM or maybe the afppasswd, but nothing seems to work, I don't see any PAM errors in syslog nor using account without any login restrictons ( /bin/sh as shell with home folder ). Thinkering with afppasswd and permissions also didn't seemed to work.

I've given logs, afp.conf and my jail config since I really don't know what's wrong. I've setup Netatalk in similar fashion around 2 or 3 years ago when my box was running Debian unstable and my PowerMac connection without a hassle under both Classic 9.2.2 and OS X 10.4.11. I hope someone more experienced will help me.

logs-dhx2.txt
logs-cleartxt.txt
logs-guest.txt
afp_conf.txt
jail_conf.txt

[rdmark]

I read through the logs, and from a netatalk perspective the authentication succeeded. My gut feel is that there's a problem with the volume permissions or perhaps the CNID database permissions due to your jail setup. Make sure that cnid_dbd is allowed to write to the CNID dir (under the state directory as indicated if you run "afpd -V") and that the shared volume dir has reasonable permissions for the users that need to access it.

You can turn on maxdebug as well and see if that gives us more hints.

What version of netatalk is this, and which clients are you using to connect to it?

[SoniDIFF]

I'm running version 4.4.0, both my jail and main system are running FreeBSD 15 and I was trying to connect trough Finder from version 10.4.11 ( and trough 9.2.2 at the beginning ). I don't have time today to diagnose my setup but I will go back to it tomorrow and I also quicky checked output from maxdebug.

maxdebug.txt

[rdmark]

the one new thing we learn from these logs is that netatalk gets a SIGTERM signal from somewhere and shuts down

[SoniDIFF]

Oh yea, that was me. I copied the logs after I stop the service

[SoniDIFF]

User's / Directory's permissons are fine ( I could read and write as a said user in shell )

I'm not sure what you meant with cnid_dbd.
Is it a process running as root or as some user? How can I check it? (since I can't find anything about it)
By experimenting it seems CNID database for "share" is created only when I login as guest and mount the volume, trying to login as my user doesn't generate the database when it's deleted.

I would definitely tried doing more with guest user but when trying to do anything with volume, I'm getting this from FreeBSD's dmesg
Soni-Serv kernel: pid 86768 (afpd), jid 3, uid 65534: exited on signal 6 (no core dump - sugid process denied by kern.sugid_coredump)
and my 10.4 that I'm using for testing freezes entierly. I can move my cursor, but entire desktop becomes unresponsive, forcing me to hard reset. ( It's because of nobody user been locked, not really relevant to core issue but I didn't have much new to post so I included it anyway )

I forgot to add that I'm not very experienced with FreeBSD (or Unix / Linux enviorments in general)
so for me those problems are hard to tackle when logs aren't helping and it's not a simple problem like permissions, I hope you will be understanding.

PS. My ZFS dataset is not inside of jail's and is mounted with nullfs by fstab that my jail.conf points to, forgot to note that earlier. I tried with new jail with everything inside and the same jail.conf, but with no success. I will try tomorrow with new FreeBSD installation in Hyper-V without any jail and PF.

[SoniDIFF]

Permissions inside CNID were standard 755 and 644

[SoniDIFF]

I've tested Netatalk 4.4.0 on fresh installation of FreeBSD 15 and it worked fine. I tried setting some jail parameters like allow.sysvipc; with no success.

At this point I may have to give up and setup a FTP server instead, but I still hope someone could help me figure this out.

[SoniDIFF]

Kind of unsatisfying ending, but I suppose you can't have everything in life. I tought that SQLite was experimental, but it seams like version of manual on man.freebsd.org wasn't updated after 4.3.2 ( probably will fix itself )

Thanks for assistance, I hope that will get fixed in the future, maybe it's worth noting that dbd is broken in jails on the website ( and the fact that MySQL isn't compiled by default on FreeBSD Port ).

[rdmark]

you should always use the "man" command on your system for the latest man pages rather than looking them up on the web

I'm not convinced that the dbd backend cannot work in FreeBSD jails with the right configuration. I suggest that you try the sqlite backend to compare if makes a difference compared to dbd.

[SoniDIFF]

Oh yea, that reminds me. Netatalk Port on FreeBSD is dependent on Oracle Berkeley DB 18.1 ( db18 ) which doesn't had a maintainer for about 3 months ( last update to it was a year ago ), I wonder if something broke on FreeBSD 15, I don't have any experience with Netatalk on earlier versions of FreeBSD, so it's only my speculation.

[rdmark]

you can try to contact Marcus, the maintainer of the netatalk port -- he is usually responsive and helpful

I created the sqlite CNID backend as the future-proof alternative to dbd (which is the one using BerkeleyDB) and I think this is a good time for the FreeBSD port to start shipping with it

[rdmark]

for context, BerkeleyDB is effectively abandonware at this point, and open source operating systems have started dropping it from distribution in recent years