X-Git-Url: https://git.decadent.org.uk/gitweb/?p=nfs-utils.git;a=blobdiff_plain;f=utils%2Fgssd%2Fkrb5_util.c;h=5d433b121ee26b96f2319fec04eda6eca638dc18;hp=5f3e490c75c1a338ea42a0215315c9e7b15f9c5b;hb=3a09fc138b1347ec5b20351674d3d901bc961937;hpb=62c4197d5b41b66af58c34a4cc79c023599f0f72

diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
index 5f3e490..5d433b1 100644
--- a/utils/gssd/krb5_util.c
+++ b/utils/gssd/krb5_util.c
@@ -103,8 +103,11 @@
 
 #include <stdio.h>
 #include <stdlib.h>
+#include <unistd.h>
 #include <string.h>
 #include <dirent.h>
+#include <netdb.h>
+#include <ctype.h>
 #include <errno.h>
 #include <time.h>
 #include <gssapi/gssapi.h>
@@ -135,6 +138,7 @@ static int gssd_have_realm_ple(void *realm);
 static int gssd_process_krb5_keytab(krb5_context context, krb5_keytab kt,
 		char *kt_name);
 
+
 /*
  * Called from the scandir function to weed out potential krb5
  * credentials cache files
@@ -158,7 +162,7 @@ select_krb5_ccache(const struct dirent *d)
 }
 
 /*
- * Look in the GSSD_DEFAULT_CRED_DIR for files that look like they
+ * Look in the ccachedir for files that look like they
  * are Kerberos Credential Cache files for a given UID.  Return
  * non-zero and the dirent pointer for the entry most likely to be
  * what we want. Otherwise, return zero and no dirent pointer.
@@ -178,78 +182,73 @@ gssd_find_existing_krb5_ccache(uid_t uid, struct dirent **d)
 	struct dirent *best_match_dir = NULL;
 	struct stat best_match_stat, tmp_stat;
 
+	memset(&best_match_stat, 0, sizeof(best_match_stat));
 	*d = NULL;
-	n = scandir(GSSD_DEFAULT_CRED_DIR, &namelist, select_krb5_ccache, 0);
+	n = scandir(ccachedir, &namelist, select_krb5_ccache, 0);
 	if (n < 0) {
 		perror("scandir looking for krb5 credentials caches");
 	}
 	else if (n > 0) {
-		char substring[128];
-		char fullstring[128];
 		char statname[1024];
-		snprintf(substring, sizeof(substring), "_%d_", uid);
-		snprintf(fullstring, sizeof(fullstring), "_%d", uid);
 		for (i = 0; i < n; i++) {
 			printerr(3, "CC file '%s' being considered\n",
 				 namelist[i]->d_name);
-			if (strstr(namelist[i]->d_name, substring) ||
-			    !strcmp(namelist[i]->d_name, fullstring)) {
-				snprintf(statname, sizeof(statname),
-					 "%s/%s", GSSD_DEFAULT_CRED_DIR,
-					 namelist[i]->d_name);
-				if (stat(statname, &tmp_stat)) {
-					printerr(0, "Error doing stat "
-						    "on file '%s'\n",
-						 statname);
-					continue;
-				}
-				if (!S_ISREG(tmp_stat.st_mode)) {
-					printerr(3, "File '%s' is not "
-						    "a regular file\n",
-						 statname);
-					continue;
-				}
-				printerr(3, "CC file '%s' matches "
-					    "name check and has "
-					    "mtime of %u\n",
-					 namelist[i]->d_name,
-					 tmp_stat.st_mtime);
-				/* if more than one match is found,
-				 * return the most recent (the one
-				 * with the latest mtime),
-				 * and don't free the dirent */
-				if (!found) {
+			snprintf(statname, sizeof(statname),
+				 "%s/%s", ccachedir, namelist[i]->d_name);
+			if (lstat(statname, &tmp_stat)) {
+				printerr(0, "Error doing stat on file '%s'\n",
+					 statname);
+				free(namelist[i]);
+				continue;
+			}
+			/* Only pick caches owned by the user (uid) */
+			if (tmp_stat.st_uid != uid) {
+				printerr(3, "'%s' owned by %u, not %u\n",
+					 statname, tmp_stat.st_uid, uid);
+				free(namelist[i]);
+				continue;
+			}
+			if (!S_ISREG(tmp_stat.st_mode)) {
+				printerr(3, "'%s' is not a regular file\n",
+					 statname);
+				free(namelist[i]);
+				continue;
+			}
+			printerr(3, "CC file '%s' matches owner check and has "
+				 "mtime of %u\n",
+				 namelist[i]->d_name, tmp_stat.st_mtime);
+			/*
+			 * if more than one match is found, return the most
+			 * recent (the one with the latest mtime), and
+			 * don't free the dirent
+			 */
+			if (!found) {
+				best_match_dir = namelist[i];
+				best_match_stat = tmp_stat;
+				found++;
+			}
+			else {
+				/*
+				 * If the current match has an mtime later
+				 * than the one we are looking at, then use
+				 * the current match.  Otherwise, we still
+				 * have the best match.
+				 */
+				if (tmp_stat.st_mtime >
+					    best_match_stat.st_mtime) {
+					free(best_match_dir);
 					best_match_dir = namelist[i];
 					best_match_stat = tmp_stat;
-					found++;
 				}
 				else {
-					/*
-					 * If the current match has
-					 * an mtime later than the
-					 * one we are looking at,
-					 * then use the current match.
-					 * Otherwise, we still have
-					 * the best match.
-					 */
-					if (tmp_stat.st_mtime >
-						    best_match_stat.st_mtime) {
-						free(best_match_dir);
-						best_match_dir = namelist[i];
-						best_match_stat = tmp_stat;
-					}
-					else {
-						free(namelist[i]);
-					}
-					printerr(3, "CC file '%s' is our "
-						    "current best match "
-						    "with mtime of %u\n",
-						 best_match_dir->d_name,
-						 best_match_stat.st_mtime);
+					free(namelist[i]);
 				}
+				printerr(3, "CC file '%s' is our "
+					    "current best match "
+					    "with mtime of %u\n",
+					 best_match_dir->d_name,
+					 best_match_stat.st_mtime);
 			}
-			else
-				free(namelist[i]);
 		}
 		free(namelist);
 	}
@@ -280,11 +279,16 @@ limit_krb5_enctypes(struct rpc_gss_sec *sec, uid_t uid)
 {
 	u_int maj_stat, min_stat;
 	gss_cred_id_t credh;
+	gss_OID_set_desc  desired_mechs;
 	krb5_enctype enctypes[] = { ENCTYPE_DES_CBC_CRC };
 	int num_enctypes = sizeof(enctypes) / sizeof(enctypes[0]);
 
+	/* We only care about getting a krb5 cred */
+	desired_mechs.count = 1;
+	desired_mechs.elements = &krb5oid;
+
 	maj_stat = gss_acquire_cred(&min_stat, NULL, 0,
-				    GSS_C_NULL_OID_SET, GSS_C_INITIATE,
+				    &desired_mechs, GSS_C_INITIATE,
 				    &credh, NULL, NULL);
 
 	if (maj_stat != GSS_S_COMPLETE) {
@@ -298,6 +302,7 @@ limit_krb5_enctypes(struct rpc_gss_sec *sec, uid_t uid)
 	if (maj_stat != GSS_S_COMPLETE) {
 		pgsserr("gss_set_allowable_enctypes",
 			maj_stat, min_stat, &krb5oid);
+		gss_release_cred(&min_stat, &credh);
 		return -1;
 	}
 	sec->cred = credh;
@@ -328,6 +333,8 @@ gssd_get_single_krb5_cred(krb5_context context,
 	char cc_name[BUFSIZ];
 	int code;
 	time_t now = time(0);
+	char *cache_type;
+	char *pname = NULL;
 
 	memset(&my_creds, 0, sizeof(my_creds));
 
@@ -344,6 +351,9 @@ gssd_get_single_krb5_cred(krb5_context context,
 		goto out;
 	}
 
+	if ((krb5_unparse_name(context, ple->princ, &pname)))
+		pname = NULL;
+
 	krb5_get_init_creds_opt_init(&options);
 	krb5_get_init_creds_opt_set_address_list(&options, NULL);
 
@@ -352,21 +362,12 @@ gssd_get_single_krb5_cred(krb5_context context,
 	printerr(0, "WARNING: Using (debug) short machine cred lifetime!\n");
 	krb5_get_init_creds_opt_set_tkt_life(&options, 5*60);
 #endif
-        if ((code = krb5_get_init_creds_keytab(context, &my_creds, ple->princ,
-	                                  kt, 0, NULL, &options))) {
-		char *pname;
-		if ((krb5_unparse_name(context, ple->princ, &pname))) {
-			pname = NULL;
-		}
+	if ((code = krb5_get_init_creds_keytab(context, &my_creds, ple->princ,
+					       kt, 0, NULL, &options))) {
 		printerr(0, "WARNING: %s while getting initial ticket for "
-			    "principal '%s' from keytab '%s'\n",
+			 "principal '%s' using keytab '%s'\n",
 			 error_message(code),
 			 pname ? pname : "<unparsable>", kt_name);
-#ifdef HAVE_KRB5
-		if (pname) krb5_free_unparsed_name(context, pname);
-#else
-		if (pname) free(pname);
-#endif
 		goto out;
 	}
 
@@ -374,14 +375,21 @@ gssd_get_single_krb5_cred(krb5_context context,
 	 * Initialize cache file which we're going to be using
 	 */
 
-	snprintf(cc_name, sizeof(cc_name), "FILE:%s/%s%s_%s",
+	if (use_memcache)
+	    cache_type = "MEMORY";
+	else
+	    cache_type = "FILE";
+	snprintf(cc_name, sizeof(cc_name), "%s:%s/%s%s_%s",
+		cache_type,
 		GSSD_DEFAULT_CRED_DIR, GSSD_DEFAULT_CRED_PREFIX,
 		GSSD_DEFAULT_MACHINE_CRED_SUFFIX, ple->realm);
 	ple->endtime = my_creds.times.endtime;
+	if (ple->ccname != NULL)
+		free(ple->ccname);
 	ple->ccname = strdup(cc_name);
 	if (ple->ccname == NULL) {
 		printerr(0, "ERROR: no storage to duplicate credentials "
-			    "cache name\n");
+			    "cache name '%s'\n", cc_name);
 		code = ENOMEM;
 		goto out;
 	}
@@ -402,8 +410,11 @@ gssd_get_single_krb5_cred(krb5_context context,
 	}
 
 	code = 0;
-	printerr(1, "Using (machine) credentials cache: '%s'\n", cc_name);
+	printerr(2, "Successfully obtained machine credentials for "
+		 "principal '%s' stored in ccache '%s'\n", pname, cc_name);
   out:
+	if (pname)
+		k5_free_unparsed_name(context, pname);
 	if (ccache)
 		krb5_cc_close(context, ccache);
 	krb5_free_cred_contents(context, &my_creds);
@@ -442,7 +453,7 @@ gssd_have_realm_ple(void *r)
 
 /*
  * Process the given keytab file and create a list of principals we
- * might use to perform mount operations.
+ * might use as machine credentials.
  *
  * Returns:
  *	0 => Sucess
@@ -459,9 +470,8 @@ gssd_process_krb5_keytab(krb5_context context, krb5_keytab kt, char *kt_name)
 
 	/*
 	 * Look through each entry in the keytab file and determine
-	 * if we might want to use it later to do a mount.  If so,
-	 * save info in the global principal list
-	 * (gssd_k5_kt_princ_list).
+	 * if we might want to use it as machine credentials.  If so,
+	 * save info in the global principal list (gssd_k5_kt_princ_list).
 	 * Note: (ple == principal list entry)
 	 */
 	if ((code = krb5_kt_start_seq_get(context, kt, &cursor))) {
@@ -479,31 +489,20 @@ gssd_process_krb5_keytab(krb5_context context, krb5_keytab kt, char *kt_name)
 			printerr(0, "WARNING: Skipping keytab entry because "
 				    "we failed to unparse principal name: %s\n",
 				 error_message(code));
+			krb5_kt_free_entry(context, &kte);
 			continue;
 		}
 		printerr(2, "Processing keytab entry for principal '%s'\n",
 			 pname);
-#ifdef HAVE_KRB5
-		if ( (kte.principal->data[0].length == GSSD_SERVICE_NAME_LEN) &&
-		     (strncmp(kte.principal->data[0].data, GSSD_SERVICE_NAME,
-			      GSSD_SERVICE_NAME_LEN) == 0) &&
-#else
-		if ( (strlen(kte.principal->name.name_string.val[0]) == GSSD_SERVICE_NAME_LEN) &&
-		     (strncmp(kte.principal->name.name_string.val[0], GSSD_SERVICE_NAME,
-			      GSSD_SERVICE_NAME_LEN) == 0) &&
-			      
-#endif
-		     (!gssd_have_realm_ple((void *)&kte.principal->realm)) ) {
-			printerr(2, "We will use this entry (%s)\n", pname);
+		/* Just use the first keytab entry found for each realm */
+	        if ((!gssd_have_realm_ple((void *)&kte.principal->realm)) ) {
+			printerr(2, "We WILL use this entry (%s)\n", pname);
 			ple = malloc(sizeof(struct gssd_k5_kt_princ));
 			if (ple == NULL) {
 				printerr(0, "ERROR: could not allocate storage "
 					    "for principal list entry\n");
-#ifdef HAVE_KRB5
-				krb5_free_unparsed_name(context, pname);
-#else
-				free(pname);
-#endif
+				k5_free_unparsed_name(context, pname);
+				krb5_kt_free_entry(context, &kte);
 				retval = ENOMEM;
 				goto out;
 			}
@@ -522,11 +521,8 @@ gssd_process_krb5_keytab(krb5_context context, krb5_keytab kt, char *kt_name)
 				printerr(0, "ERROR: %s while copying realm to "
 					    "principal list entry\n",
 					 "not enough memory");
-#ifdef HAVE_KRB5
-				krb5_free_unparsed_name(context, pname);
-#else
-				free(pname);
-#endif
+				k5_free_unparsed_name(context, pname);
+				krb5_kt_free_entry(context, &kte);
 				retval = ENOMEM;
 				goto out;
 			}
@@ -535,11 +531,8 @@ gssd_process_krb5_keytab(krb5_context context, krb5_keytab kt, char *kt_name)
 				printerr(0, "ERROR: %s while copying principal "
 					    "to principal list entry\n",
 					error_message(code));
-#ifdef HAVE_KRB5
-				krb5_free_unparsed_name(context, pname);
-#else
-				free(pname);
-#endif
+				k5_free_unparsed_name(context, pname);
+				krb5_kt_free_entry(context, &kte);
 				retval = code;
 				goto out;
 			}
@@ -554,11 +547,8 @@ gssd_process_krb5_keytab(krb5_context context, krb5_keytab kt, char *kt_name)
 			printerr(2, "We will NOT use this entry (%s)\n",
 				pname);
 		}
-#ifdef HAVE_KRB5
-		krb5_free_unparsed_name(context, pname);
-#else
-		free(pname);
-#endif
+		k5_free_unparsed_name(context, pname);
+		krb5_kt_free_entry(context, &kte);
 	}
 
 	if ((code = krb5_kt_end_seq_get(context, kt, &cursor))) {
@@ -603,6 +593,403 @@ gssd_set_krb5_ccache_name(char *ccname)
 #endif
 }
 
+/*
+ * Given a principal, find a matching ple structure
+ */
+static struct gssd_k5_kt_princ *
+find_ple_by_princ(krb5_context context, krb5_principal princ)
+{
+	struct gssd_k5_kt_princ *ple;
+
+	for (ple = gssd_k5_kt_princ_list; ple != NULL; ple = ple->next) {
+		if (krb5_principal_compare(context, ple->princ, princ))
+			return ple;
+	}
+	/* no match found */
+	return NULL;
+}
+
+/*
+ * Create, initialize, and add a new ple structure to the global list
+ */
+static struct gssd_k5_kt_princ *
+new_ple(krb5_context context, krb5_principal princ)
+{
+	struct gssd_k5_kt_princ *ple = NULL, *p;
+	krb5_error_code code;
+	char *default_realm;
+	int is_default_realm = 0;
+
+	ple = malloc(sizeof(struct gssd_k5_kt_princ));
+	if (ple == NULL)
+		goto outerr;
+	memset(ple, 0, sizeof(*ple));
+
+#ifdef HAVE_KRB5
+	ple->realm = strndup(princ->realm.data,
+			     princ->realm.length);
+#else
+	ple->realm = strdup(princ->realm);
+#endif
+	if (ple->realm == NULL)
+		goto outerr;
+	code = krb5_copy_principal(context, princ, &ple->princ);
+	if (code)
+		goto outerr;
+
+	/*
+	 * Add new entry onto the list (if this is the default
+	 * realm, always add to the front of the list)
+	 */
+
+	code = krb5_get_default_realm(context, &default_realm);
+	if (code == 0) {
+		if (strcmp(ple->realm, default_realm) == 0)
+			is_default_realm = 1;
+		k5_free_default_realm(context, default_realm);
+	}
+
+	if (is_default_realm) {
+		ple->next = gssd_k5_kt_princ_list;
+		gssd_k5_kt_princ_list = ple;
+	} else {
+		p = gssd_k5_kt_princ_list;
+		while (p != NULL && p->next != NULL)
+			p = p->next;
+		if (p == NULL)
+			gssd_k5_kt_princ_list = ple;
+		else
+			p->next = ple;
+	}
+
+	return ple;
+outerr:
+	if (ple) {
+		if (ple->realm)
+			free(ple->realm);
+		free(ple);
+	}
+	return NULL;
+}
+
+/*
+ * Given a principal, find an existing ple structure, or create one
+ */
+static struct gssd_k5_kt_princ *
+get_ple_by_princ(krb5_context context, krb5_principal princ)
+{
+	struct gssd_k5_kt_princ *ple;
+
+	/* Need to serialize list if we ever become multi-threaded! */
+
+	ple = find_ple_by_princ(context, princ);
+	if (ple == NULL) {
+		ple = new_ple(context, princ);
+	}
+
+	return ple;
+}
+
+/*
+ * Given a (possibly unqualified) hostname,
+ * return the fully qualified (lower-case!) hostname
+ */
+static int
+get_full_hostname(const char *inhost, char *outhost, int outhostlen)
+{
+	struct addrinfo *addrs = NULL;
+	struct addrinfo hints;
+	int retval;
+	char *c;
+
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_flags = AI_CANONNAME;
+
+	/* Get full target hostname */
+	retval = getaddrinfo(inhost, NULL, &hints, &addrs);
+	if (retval) {
+		printerr(0, "%s while getting full hostname for '%s'\n",
+			 gai_strerror(retval), inhost);
+		goto out;
+	}
+	strncpy(outhost, addrs->ai_canonname, outhostlen);
+	freeaddrinfo(addrs);
+	for (c = outhost; *c != '\0'; c++)
+	    *c = tolower(*c);
+
+	printerr(3, "Full hostname for '%s' is '%s'\n", inhost, outhost);
+	retval = 0;
+out:
+	return retval;
+}
+
+/* 
+ * If principal matches the given realm and service name,
+ * and has *any* instance (hostname), return 1.
+ * Otherwise return 0, indicating no match.
+ */
+static int
+realm_and_service_match(krb5_context context, krb5_principal p,
+			const char *realm, const char *service)
+{
+#ifdef HAVE_KRB5
+	/* Must have two components */
+	if (p->length != 2)
+		return 0;
+	if ((strlen(realm) == p->realm.length)
+	    && (strncmp(realm, p->realm.data, p->realm.length) == 0)
+	    && (strlen(service) == p->data[0].length)
+	    && (strncmp(service, p->data[0].data, p->data[0].length) == 0))
+		return 1;
+#else
+	const char *name, *inst;
+
+	if (p->name.name_string.len != 2)
+		return 0;
+	name = krb5_principal_get_comp_string(context, p, 0);
+	inst = krb5_principal_get_comp_string(context, p, 1);
+	if (name == NULL || inst == NULL)
+		return 0;
+	if ((strcmp(realm, p->realm) == 0)
+	    && (strcmp(service, name) == 0))
+		return 1;
+#endif
+	return 0;
+}
+
+/*
+ * Search the given keytab file looking for an entry with the given
+ * service name and realm, ignoring hostname (instance).
+ *
+ * Returns:
+ *	0 => No error
+ *	non-zero => An error occurred
+ *
+ * If a keytab entry is found, "found" is set to one, and the keytab
+ * entry is returned in "kte".  Otherwise, "found" is zero, and the
+ * value of "kte" is unpredictable.
+ */
+static int
+gssd_search_krb5_keytab(krb5_context context, krb5_keytab kt,
+			const char *realm, const char *service,
+			int *found, krb5_keytab_entry *kte)
+{
+	krb5_kt_cursor cursor;
+	krb5_error_code code;
+	struct gssd_k5_kt_princ *ple;
+	int retval = -1;
+	char kt_name[BUFSIZ];
+	char *pname;
+
+	if (found == NULL) {
+		retval = EINVAL;
+		goto out;
+	}
+	*found = 0;
+
+	/*
+	 * Look through each entry in the keytab file and determine
+	 * if we might want to use it as machine credentials.  If so,
+	 * save info in the global principal list (gssd_k5_kt_princ_list).
+	 */
+	if ((code = krb5_kt_get_name(context, kt, kt_name, BUFSIZ))) {
+		printerr(0, "ERROR: %s attempting to get keytab name\n",
+			 error_message(code));
+		retval = code;
+		goto out;
+	}
+	if ((code = krb5_kt_start_seq_get(context, kt, &cursor))) {
+		printerr(0, "ERROR: %s while beginning keytab scan "
+			    "for keytab '%s'\n",
+			error_message(code), kt_name);
+		retval = code;
+		goto out;
+	}
+
+	while ((code = krb5_kt_next_entry(context, kt, kte, &cursor)) == 0) {
+		if ((code = krb5_unparse_name(context, kte->principal,
+					      &pname))) {
+			printerr(0, "WARNING: Skipping keytab entry because "
+				 "we failed to unparse principal name: %s\n",
+				 error_message(code));
+			k5_free_kt_entry(context, kte);
+			continue;
+		}
+		printerr(4, "Processing keytab entry for principal '%s'\n",
+			 pname);
+		/* Use the first matching keytab entry found */
+	        if ((realm_and_service_match(context, kte->principal, realm,
+					     service))) {
+			printerr(4, "We WILL use this entry (%s)\n", pname);
+			ple = get_ple_by_princ(context, kte->principal);
+			/*
+			 * Return, don't free, keytab entry if
+			 * we were successful!
+			 */
+			if (ple == NULL) {
+				retval = ENOMEM;
+				k5_free_kt_entry(context, kte);
+			} else {
+				retval = 0;
+				*found = 1;
+			}
+			k5_free_unparsed_name(context, pname);
+			break;
+		}
+		else {
+			printerr(4, "We will NOT use this entry (%s)\n",
+				pname);
+		}
+		k5_free_unparsed_name(context, pname);
+		k5_free_kt_entry(context, kte);
+	}
+
+	if ((code = krb5_kt_end_seq_get(context, kt, &cursor))) {
+		printerr(0, "WARNING: %s while ending keytab scan for "
+			    "keytab '%s'\n",
+			 error_message(code), kt_name);
+	}
+
+	retval = 0;
+  out:
+	return retval;
+}
+
+/*
+ * Find a keytab entry to use for a given target hostname.
+ * Tries to find the most appropriate keytab to use given the
+ * name of the host we are trying to connect with.
+ */
+static int
+find_keytab_entry(krb5_context context, krb5_keytab kt, const char *hostname,
+		  krb5_keytab_entry *kte)
+{
+	krb5_error_code code;
+	const char *svcnames[] = { "root", "nfs", "host", NULL };
+	char **realmnames = NULL;
+	char myhostname[NI_MAXHOST], targethostname[NI_MAXHOST];
+	int i, j, retval;
+	char *default_realm = NULL;
+	char *realm;
+	int tried_all = 0, tried_default = 0;
+	krb5_principal princ;
+
+
+	/* Get full target hostname */
+	retval = get_full_hostname(hostname, targethostname,
+				   sizeof(targethostname));
+	if (retval)
+		goto out;
+
+	/* Get full local hostname */
+	retval = gethostname(myhostname, sizeof(myhostname));
+	if (retval) {
+		printerr(1, "%s while getting local hostname\n",
+			 error_message(retval));
+		goto out;
+	}
+	retval = get_full_hostname(myhostname, myhostname, sizeof(myhostname));
+	if (retval)
+		goto out;
+
+	code = krb5_get_default_realm(context, &default_realm);
+	if (code) {
+		retval = code;
+		printerr(1, "%s while getting default realm name\n",
+			 error_message(code));
+		goto out;
+	}
+
+	/*
+	 * Get the realm name(s) for the target hostname.
+	 * In reality, this function currently only returns a
+	 * single realm, but we code with the assumption that
+	 * someday it may actually return a list.
+	 */
+	code = krb5_get_host_realm(context, targethostname, &realmnames);
+	if (code) {
+		printerr(0, "ERROR: %s while getting realm(s) for host '%s'\n",
+			 error_message(code), targethostname);
+		retval = code;
+		goto out;
+	}
+
+	/*
+	 * Try the "appropriate" realm first, and if nothing found for that
+	 * realm, try the default realm (if it hasn't already been tried).
+	 */
+	i = 0;
+	realm = realmnames[i];
+	while (1) {
+		if (realm == NULL) {
+			tried_all = 1;
+			if (!tried_default)
+				realm = default_realm;
+		}
+		if (tried_all && tried_default)
+			break;
+		if (strcmp(realm, default_realm) == 0)
+			tried_default = 1;
+		for (j = 0; svcnames[j] != NULL; j++) {
+			code = krb5_build_principal_ext(context, &princ,
+							strlen(realm),
+							realm,
+							strlen(svcnames[j]),
+							svcnames[j],
+							strlen(myhostname),
+							myhostname,
+							NULL);
+			if (code) {
+				printerr(1, "%s while building principal for "
+					 "'%s/%s@%s'\n", error_message(code),
+					 svcnames[j], myhostname, realm);
+				continue;
+			}
+			code = krb5_kt_get_entry(context, kt, princ, 0, 0, kte);
+			krb5_free_principal(context, princ);
+			if (code) {
+				printerr(3, "%s while getting keytab entry for "
+					 "'%s/%s@%s'\n", error_message(code),
+					 svcnames[j], myhostname, realm);
+			} else {
+				printerr(3, "Success getting keytab entry for "
+					 "'%s/%s@%s'\n",
+					 svcnames[j], myhostname, realm);
+				retval = 0;
+				goto out;
+			}
+			retval = code;
+		}
+		/*
+		 * Nothing found with our hostname instance, now look for
+		 * names with any instance (they must have an instance)
+		 */
+		for (j = 0; svcnames[j] != NULL; j++) {
+			int found = 0;
+			code = gssd_search_krb5_keytab(context, kt, realm,
+						       svcnames[j], &found, kte);
+			if (!code && found) {
+				printerr(3, "Success getting keytab entry for "
+					 "%s/*@%s\n", svcnames[j], realm);
+				retval = 0;
+				goto out;
+			}
+		}
+		if (!tried_all) {
+			i++;
+			realm = realmnames[i];
+		}
+	}
+out:
+	if (default_realm)
+		k5_free_default_realm(context, default_realm);
+	if (realmnames)
+		krb5_free_host_realm(context, realmnames);
+	return retval;
+}
+
 /*==========================*/
 /*===  External routines ===*/
 /*==========================*/
@@ -626,13 +1013,12 @@ gssd_setup_krb5_user_gss_ccache(uid_t uid, char *servername)
 	memset(buf, 0, sizeof(buf));
 	if (gssd_find_existing_krb5_ccache(uid, &d)) {
 		snprintf(buf, sizeof(buf), "FILE:%s/%s",
-			GSSD_DEFAULT_CRED_DIR, d->d_name);
+			ccachedir, d->d_name);
 		free(d);
 	}
 	else
 		snprintf(buf, sizeof(buf), "FILE:%s/%s%u",
-			GSSD_DEFAULT_CRED_DIR,
-			GSSD_DEFAULT_CRED_PREFIX, uid);
+			ccachedir, GSSD_DEFAULT_CRED_PREFIX, uid);
 	printerr(2, "using %s as credentials cache for client with "
 		    "uid %u for server %s\n", buf, uid, servername);
 	gssd_set_krb5_ccache_name(buf);
@@ -764,18 +1150,19 @@ gssd_get_krb5_machine_cred_list(char ***list)
 	retval = -1;
 	*list = (char **) NULL;
 
-	/* Refresh machine credentials */
-	if ((retval = gssd_refresh_krb5_machine_creds())) {
-		goto out;
-	}
-
 	if ((l = (char **) malloc(listsize * sizeof(char *))) == NULL) {
 		retval = ENOMEM;
 		goto out;
 	}
 
+	/* Need to serialize list if we ever become multi-threaded! */
+
 	for (ple = gssd_k5_kt_princ_list; ple; ple = ple->next) {
 		if (ple->ccname) {
+			/* Make sure cred is up-to-date before returning it */
+			retval = gssd_refresh_krb5_machine_credential(NULL, ple);
+			if (retval)
+				continue;
 			if (i + 1 > listsize) {
 				listsize += listinc;
 				l = (char **)
@@ -855,3 +1242,68 @@ gssd_destroy_krb5_machine_creds(void)
 	krb5_free_context(context);
 }
 
+/*
+ * Obtain (or refresh if necessary) Kerberos machine credentials
+ */
+int
+gssd_refresh_krb5_machine_credential(char *hostname,
+				     struct gssd_k5_kt_princ *ple)
+{
+	krb5_error_code code = 0;
+	krb5_context context;
+	krb5_keytab kt = NULL;;
+	int retval = 0;
+
+	if (hostname == NULL && ple == NULL)
+		return EINVAL;
+
+	code = krb5_init_context(&context);
+	if (code) {
+		printerr(0, "ERROR: %s: %s while initializing krb5 context\n",
+			 __FUNCTION__, error_message(code));
+		retval = code;
+		goto out;
+	}
+
+	if ((code = krb5_kt_resolve(context, keytabfile, &kt))) {
+		printerr(0, "ERROR: %s: %s while resolving keytab '%s'\n",
+			 __FUNCTION__, error_message(code), keytabfile);
+		goto out;
+	}
+
+	if (ple == NULL) {
+		krb5_keytab_entry kte;
+
+		code = find_keytab_entry(context, kt, hostname, &kte);
+		if (code) {
+			printerr(0, "ERROR: %s: no usable keytab entry found "
+				 "in keytab %s for connection with host %s\n",
+				 __FUNCTION__, keytabfile, hostname);
+			retval = code;
+			goto out;
+		}
+
+		ple = get_ple_by_princ(context, kte.principal);
+		k5_free_kt_entry(context, &kte);
+		if (ple == NULL) {
+			char *pname;
+			if ((krb5_unparse_name(context, kte.principal, &pname))) {
+				pname = NULL;
+			}
+			printerr(0, "ERROR: %s: Could not locate or create "
+				 "ple struct for principal %s for connection "
+				 "with host %s\n",
+				 __FUNCTION__, pname ? pname : "<unparsable>",
+				 hostname);
+			if (pname) k5_free_unparsed_name(context, pname);
+			goto out;
+		}
+	}
+	retval = gssd_get_single_krb5_cred(context, kt, ple);
+out:
+	if (kt)
+		krb5_kt_close(context, kt);
+	krb5_free_context(context);
+	return retval;
+}
+