* can not start NFSv4 with Kerberos 5 @ 2007-04-03 10:10 Phillip 2007-04-03 11:46 ` William A. (Andy) Adamson 0 siblings, 1 reply; 9+ messages in thread From: Phillip @ 2007-04-03 10:10 UTC (permalink / raw) To: nfs Hi folks, Currently we plan to use NFSV4 with Kerberos: KDC: Windows 2K AD NFSv4 server: CentOS 4.4 with 2.6.20 kernel # cat /etc/exports /XFS/NFS4 gss/krb5 (rw,fsid=0,insecure,no_root_squash,no_subtree_check,sync) Client: CentOS 4.4 When I use Ktpass to create keytab: C:> Ktpass princ administrator/PLASMON.SIT@PLASMON.SIT mapuser administrator -pass admin out unixmachine.keytab C:> Ktpass princ root/PLAMONS.SIT@PLASMON.SIT mapuser root -pass admin out unixmachine_1.keytab and copy this output keytabs to NFSv4 server, and then export them with kinit well. However, when I attempt to start NFS service, the rpcsvcgssd failed. Then I try to execute these below commands [root@nfsv4 kevin]# rpc.svcgssd -fvvv ERROR: GSS-API: error in gss_import_name(): An invalid name was supplied - Hostname cannot be canonicalized unable to obtain root (machine) credentials do you have a keytab entry for nfs/<your.host>@<YOUR.REALM> in /etc/krb5.keytab? [root@nfsv4 kevin]# rpc.gssd -fvvv Using keytab file '/etc/krb5.keytab' Processing keytab entry for principal 'administrator/PLASMON.SIT@PLASMON.SIT' We will NOT use this entry (administrator/PLASMON.SIT@PLASMON.SIT) Processing keytab entry for principal 'root/PLASMON.SIT@PLASMON.SIT' We will NOT use this entry (root/PLASMON.SIT@PLASMON.SIT) ERROR: No usable keytab entries found in keytab '/etc/krb5.keytab' Do you have a valid keytab entry for nfs/<your.host>@<YOUR.REALM> in keytab file /etc/krb5.keytab ? Continuing without (machine) credentials - nfs4 mounts with Kerberos will fail processing client list Did I take mistakes in creating keytab? Please help me fix this issue. Thanks in advance. Regards, Phillip ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: can not start NFSv4 with Kerberos 5 2007-04-03 10:10 can not start NFSv4 with Kerberos 5 Phillip @ 2007-04-03 11:46 ` William A. (Andy) Adamson 2007-04-03 12:13 ` Phillip 2007-04-04 8:43 ` Phillip 0 siblings, 2 replies; 9+ messages in thread From: William A. (Andy) Adamson @ 2007-04-03 11:46 UTC (permalink / raw) To: Phillip; +Cc: nfs [-- Attachment #1.1: Type: text/plain, Size: 2547 bytes --] On 4/3/07, Phillip <phuang@plasmon.cn> wrote: > > Hi folks, > > Currently we plan to use NFSV4 with Kerberos: > KDC: Windows 2K AD > > NFSv4 server: CentOS 4.4 with 2.6.20 kernel > # cat /etc/exports > /XFS/NFS4 gss/krb5 > (rw,fsid=0,insecure,no_root_squash,no_subtree_check,sync) > > Client: CentOS 4.4 > > When I use Ktpass to create keytab: > > C:> Ktpass princ administrator/PLASMON.SIT@PLASMON.SIT mapuser > administrator -pass admin out unixmachine.keytab > C:> Ktpass princ root/PLAMONS.SIT@PLASMON.SIT mapuser root -pass admin > out unixmachine_1.keytab > > > and copy this output keytabs to NFSv4 server, and then export them with > kinit well. > > However, when I attempt to start NFS service, the rpcsvcgssd failed. > > Then I try to execute these below commands > > [root@nfsv4 kevin]# rpc.svcgssd -fvvv > ERROR: GSS-API: error in gss_import_name(): An invalid name was supplied > - Hostname cannot be canonicalized > unable to obtain root (machine) credentials > do you have a keytab entry for nfs/<your.host>@<YOUR.REALM> > in /etc/krb5.keytab? as the error message on the server said: you need a keytab of the form nfs/<your.host>@<YOUR.REALM> the root/<your.host>@<YOUR.REALM> or administrator/<your.host>@<YOUR.REALM> won/t work. -->Andy [root@nfsv4 kevin]# rpc.gssd -fvvv > Using keytab file '/etc/krb5.keytab' > Processing keytab entry for principal > 'administrator/PLASMON.SIT@PLASMON.SIT' > We will NOT use this entry (administrator/PLASMON.SIT@PLASMON.SIT) > Processing keytab entry for principal 'root/PLASMON.SIT@PLASMON.SIT' > We will NOT use this entry (root/PLASMON.SIT@PLASMON.SIT) > ERROR: No usable keytab entries found in keytab '/etc/krb5.keytab' > Do you have a valid keytab entry for nfs/<your.host>@<YOUR.REALM> in > keytab file /etc/krb5.keytab ? > Continuing without (machine) credentials - nfs4 mounts with Kerberos > will fail > processing client list > > > Did I take mistakes in creating keytab? > > > Please help me fix this issue. > Thanks in advance. > > Regards, > Phillip > > > > > ------------------------------------------------------------------------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the chance to share > your > opinions on IT & business topics through brief surveys-and earn cash > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV > _______________________________________________ > NFS maillist - NFS@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/nfs > > [-- Attachment #1.2: Type: text/html, Size: 3802 bytes --] [-- Attachment #2: Type: text/plain, Size: 345 bytes --] ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV [-- Attachment #3: Type: text/plain, Size: 140 bytes --] _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: can not start NFSv4 with Kerberos 5 2007-04-03 11:46 ` William A. (Andy) Adamson @ 2007-04-03 12:13 ` Phillip 2007-04-03 13:18 ` William A. (Andy) Adamson 2007-04-04 8:43 ` Phillip 1 sibling, 1 reply; 9+ messages in thread From: Phillip @ 2007-04-03 12:13 UTC (permalink / raw) To: William A. (Andy) Adamson; +Cc: nfs Andy, Thanks for you kindly reply. As your comment: nfs/<your.host>@<YOUR.REALM> and I google the following: host/hostname@NT-DNS-REALM-NAME hostname is the host DNS name, for example, foobar.microsoft.com. NT-DNS-REALM-NAME is the uppercase name of the Windows 2000 domain; for example, RESKIT.COM. I have two questions: 1. What does the above term "host" mean? Hostname of NFS server, or service(nfs)? 2. If I set the IP address in the above "<your.host>" field, is it OK? How could I set the DNS name since I could not operate on the DNS server? Call me a piggy, but this is just where I am: I'm here for real. Regards, Phillip On Tue, 2007-04-03 at 07:46 -0400, William A. (Andy) Adamson wrote: > > > On 4/3/07, Phillip <phuang@plasmon.cn> wrote: > Hi folks, > > Currently we plan to use NFSV4 with Kerberos: > KDC: Windows 2K AD > > NFSv4 server: CentOS 4.4 with 2.6.20 kernel > # cat /etc/exports > /XFS/NFS4 gss/krb5 > (rw,fsid=0,insecure,no_root_squash,no_subtree_check,sync) > > Client: CentOS 4.4 > > When I use Ktpass to create keytab: > > C:> Ktpass princ administrator/PLASMON.SIT@PLASMON.SIT mapuser > administrator -pass admin out unixmachine.keytab > C:> Ktpass princ root/PLAMONS.SIT@PLASMON.SIT mapuser root - > pass admin > out unixmachine_1.keytab > > > and copy this output keytabs to NFSv4 server, and then export > them with > kinit well. > > However, when I attempt to start NFS service, the rpcsvcgssd > failed. > > Then I try to execute these below commands > > [root@nfsv4 kevin]# rpc.svcgssd -fvvv > ERROR: GSS-API: error in gss_import_name(): An invalid name > was supplied > - Hostname cannot be canonicalized > unable to obtain root (machine) credentials > do you have a keytab entry for nfs/<your.host>@<YOUR.REALM> > in /etc/krb5.keytab? > > as the error message on the server said: you need a keytab of the > form > > nfs/<your.host>@<YOUR.REALM> > > the root/<your.host>@<YOUR.REALM> or > administrator/<your.host>@<YOUR.REALM> won/t work. > > -->Andy > > > [root@nfsv4 kevin]# rpc.gssd -fvvv > Using keytab file '/etc/krb5.keytab' > Processing keytab entry for principal > 'administrator/PLASMON.SIT@PLASMON.SIT' > We will NOT use this entry > (administrator/PLASMON.SIT@PLASMON.SIT) > Processing keytab entry for principal > 'root/PLASMON.SIT@PLASMON.SIT' > We will NOT use this entry (root/PLASMON.SIT@PLASMON.SIT) > ERROR: No usable keytab entries found in keytab > '/etc/krb5.keytab' > Do you have a valid keytab entry for > nfs/<your.host>@<YOUR.REALM> in > keytab file /etc/krb5.keytab ? > Continuing without (machine) credentials - nfs4 mounts with > Kerberos > will fail > processing client list > > > Did I take mistakes in creating keytab? > > > Please help me fix this issue. > Thanks in advance. > > Regards, > Phillip > > > > > ------------------------------------------------------------------------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the chance > to share your > opinions on IT & business topics through brief surveys-and > earn cash > http://www.techsay.com/default.php? > page=join.php&p=sourceforge&CID=DEVDEV > _______________________________________________ > NFS maillist - NFS@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/nfs > > ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: can not start NFSv4 with Kerberos 5 2007-04-03 12:13 ` Phillip @ 2007-04-03 13:18 ` William A. (Andy) Adamson 2007-04-03 14:21 ` Kevin Coffman 0 siblings, 1 reply; 9+ messages in thread From: William A. (Andy) Adamson @ 2007-04-03 13:18 UTC (permalink / raw) To: Phillip; +Cc: nfs [-- Attachment #1.1: Type: text/plain, Size: 4914 bytes --] On 4/3/07, Phillip <phuang@plasmon.cn> wrote: > > Andy, > > Thanks for you kindly reply. > > As your comment: > nfs/<your.host>@<YOUR.REALM> > and I google the following: > host/hostname@NT-DNS-REALM-NAME > > hostname is the host DNS name, for example, foobar.microsoft.com. > NT-DNS-REALM-NAME is the uppercase name of the Windows 2000 domain; for > example, RESKIT.COM. hostname is the dns name of your host. the realm name is the name of your kerberos domain. I have two questions: > 1. What does the above term "host" mean? Hostname of NFS server, or > service(nfs)? this is kerberos speak. a kerberos service name has a "service" component (host, root, nfs, ldap, web, or whatever you want) followed by a "/" and then the dns hostname. NFSv4 requires that the NFSv4 server Kerberos service name is of the form nfs/<dnshostname>@<KERBEROS.REALM> the "host" service name is used by many other servers, but not by NFSv4. the NFSv4 client keytab name is unspecified. so, if you want you can place a keytab on the client to be used for NFSv4 - but it is not required. 2. If I set the IP address in the above "<your.host>" field, is it OK? > How could I set the DNS name since I could not operate on the DNS > server? dns name required. see http://www.citi.umich.edu/projects/nfsv4/linux/krb5-setup.html for kerberos setup instructions and http://www.citi.umich.edu/projects/nfsv4/linux/ "Instructions" section for other v4 set-up instructions. -->Andy Call me a piggy, but this is just where I am: I'm here for real. > > Regards, > Phillip > > > > On Tue, 2007-04-03 at 07:46 -0400, William A. (Andy) Adamson wrote: > > > > > > On 4/3/07, Phillip <phuang@plasmon.cn> wrote: > > Hi folks, > > > > Currently we plan to use NFSV4 with Kerberos: > > KDC: Windows 2K AD > > > > NFSv4 server: CentOS 4.4 with 2.6.20 kernel > > # cat /etc/exports > > /XFS/NFS4 gss/krb5 > > (rw,fsid=0,insecure,no_root_squash,no_subtree_check,sync) > > > > Client: CentOS 4.4 > > > > When I use Ktpass to create keytab: > > > > C:> Ktpass princ administrator/PLASMON.SIT@PLASMON.SIT mapuser > > administrator -pass admin out unixmachine.keytab > > C:> Ktpass princ root/PLAMONS.SIT@PLASMON.SIT mapuser root - > > pass admin > > out unixmachine_1.keytab > > > > > > and copy this output keytabs to NFSv4 server, and then export > > them with > > kinit well. > > > > However, when I attempt to start NFS service, the rpcsvcgssd > > failed. > > > > Then I try to execute these below commands > > > > [root@nfsv4 kevin]# rpc.svcgssd -fvvv > > ERROR: GSS-API: error in gss_import_name(): An invalid name > > was supplied > > - Hostname cannot be canonicalized > > unable to obtain root (machine) credentials > > do you have a keytab entry for nfs/<your.host>@<YOUR.REALM> > > in /etc/krb5.keytab? > > > > as the error message on the server said: you need a keytab of the > > form > > > > nfs/<your.host>@<YOUR.REALM> > > > > the root/<your.host>@<YOUR.REALM> or > > administrator/<your.host>@<YOUR.REALM> won/t work. > > > > -->Andy > > > > > > [root@nfsv4 kevin]# rpc.gssd -fvvv > > Using keytab file '/etc/krb5.keytab' > > Processing keytab entry for principal > > 'administrator/PLASMON.SIT@PLASMON.SIT' > > We will NOT use this entry > > (administrator/PLASMON.SIT@PLASMON.SIT) > > Processing keytab entry for principal > > 'root/PLASMON.SIT@PLASMON.SIT' > > We will NOT use this entry (root/PLASMON.SIT@PLASMON.SIT) > > ERROR: No usable keytab entries found in keytab > > '/etc/krb5.keytab' > > Do you have a valid keytab entry for > > nfs/<your.host>@<YOUR.REALM> in > > keytab file /etc/krb5.keytab ? > > Continuing without (machine) credentials - nfs4 mounts with > > Kerberos > > will fail > > processing client list > > > > > > Did I take mistakes in creating keytab? > > > > > > Please help me fix this issue. > > Thanks in advance. > > > > Regards, > > Phillip > > > > > > > > > > > ------------------------------------------------------------------------- > > Take Surveys. Earn Cash. Influence the Future of IT > > Join SourceForge.net's Techsay panel and you'll get the chance > > to share your > > opinions on IT & business topics through brief surveys-and > > earn cash > > http://www.techsay.com/default.php? > > page=join.php&p=sourceforge&CID=DEVDEV > > _______________________________________________ > > NFS maillist - NFS@lists.sourceforge.net > > https://lists.sourceforge.net/lists/listinfo/nfs > > > > > > [-- Attachment #1.2: Type: text/html, Size: 9661 bytes --] [-- Attachment #2: Type: text/plain, Size: 345 bytes --] ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV [-- Attachment #3: Type: text/plain, Size: 140 bytes --] _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: can not start NFSv4 with Kerberos 5 2007-04-03 13:18 ` William A. (Andy) Adamson @ 2007-04-03 14:21 ` Kevin Coffman 2007-04-04 2:17 ` Phillip 0 siblings, 1 reply; 9+ messages in thread From: Kevin Coffman @ 2007-04-03 14:21 UTC (permalink / raw) To: Phillip; +Cc: nfs On 4/3/07, William A. (Andy) Adamson <andros@citi.umich.edu> wrote: > > > On 4/3/07, Phillip <phuang@plasmon.cn> wrote: > > Andy, > > > > Thanks for you kindly reply. > > > > As your comment: > > nfs/<your.host>@<YOUR.REALM> > > and I google the following: > > host/hostname@NT-DNS-REALM-NAME > > > > hostname is the host DNS name, for example, foobar.microsoft.com. > > NT-DNS-REALM-NAME is the uppercase name of the Windows 2000 domain; for > > example, RESKIT.COM. > > hostname is the dns name of your host. the realm name is the name of your > kerberos domain. > > I have two questions: > > 1. What does the above term "host" mean? Hostname of NFS server, or > > service(nfs)? > > this is kerberos speak. > > a kerberos service name has a "service" component (host, root, nfs, ldap, > web, or whatever you want) followed by a "/" and then the dns hostname. > > NFSv4 requires that the NFSv4 server Kerberos service name is of the form > > nfs/<dnshostname>@<KERBEROS.REALM> > > the "host" service name is used by many other servers, but not by NFSv4. > > the NFSv4 client keytab name is unspecified. so, if you want you can place a > keytab on the client > to be used for NFSv4 - but it is not required. Actually, the *current* client code requires a "nfs/*@<KERBEROS.REALM>" key. (This changes in (not yet released) nfs-utils-1.1.0 so that other keys may be used.) K.C. ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: can not start NFSv4 with Kerberos 5 2007-04-03 14:21 ` Kevin Coffman @ 2007-04-04 2:17 ` Phillip 2007-04-04 15:30 ` Kevin Coffman 0 siblings, 1 reply; 9+ messages in thread From: Phillip @ 2007-04-04 2:17 UTC (permalink / raw) To: Kevin Coffman; +Cc: nfs, mzeng Hello Andy & Kevin, Thanks for your kindly help. Yes, I create the keytab by "nfs/nfsv4@PLASMON.SIT" and start rpc.gssd and rpc.svcgssd successfully. nfsv4 is the hostname of NFS server, and PLASMON.SIT is the AD domain. When Set Windows2K as KDC for NFSv4, is it necessary to user Ktpass tools to create keytab in the KDC server(Windows), and copy the keytabs to NFS server and clients? If so, it seems to be complicated and causes security problems while users have to log and access KDC server frequently. Is there other easy way to do this? We do not want to make the end-users confused. Regards, Phillip On Tue, 2007-04-03 at 10:21 -0400, Kevin Coffman wrote: > On 4/3/07, William A. (Andy) Adamson <andros@citi.umich.edu> wrote: > > > > > > On 4/3/07, Phillip <phuang@plasmon.cn> wrote: > > > Andy, > > > > > > Thanks for you kindly reply. > > > > > > As your comment: > > > nfs/<your.host>@<YOUR.REALM> > > > and I google the following: > > > host/hostname@NT-DNS-REALM-NAME > > > > > > hostname is the host DNS name, for example, foobar.microsoft.com. > > > NT-DNS-REALM-NAME is the uppercase name of the Windows 2000 domain; for > > > example, RESKIT.COM. > > > > hostname is the dns name of your host. the realm name is the name of your > > kerberos domain. > > > I have two questions: > > > 1. What does the above term "host" mean? Hostname of NFS server, or > > > service(nfs)? > > > > this is kerberos speak. > > > > a kerberos service name has a "service" component (host, root, nfs, ldap, > > web, or whatever you want) followed by a "/" and then the dns hostname. > > > > NFSv4 requires that the NFSv4 server Kerberos service name is of the form > > > > nfs/<dnshostname>@<KERBEROS.REALM> > > > > the "host" service name is used by many other servers, but not by NFSv4. > > > > the NFSv4 client keytab name is unspecified. so, if you want you can place a > > keytab on the client > > to be used for NFSv4 - but it is not required. > > Actually, the *current* client code requires a > "nfs/*@<KERBEROS.REALM>" key. (This changes in (not yet released) > nfs-utils-1.1.0 so that other keys may be used.) > > K.C. > ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: can not start NFSv4 with Kerberos 5 2007-04-04 2:17 ` Phillip @ 2007-04-04 15:30 ` Kevin Coffman 0 siblings, 0 replies; 9+ messages in thread From: Kevin Coffman @ 2007-04-04 15:30 UTC (permalink / raw) To: Phillip; +Cc: nfs, mzeng On 4/3/07, Phillip <phuang@plasmon.cn> wrote: > Hello Andy & Kevin, > > Thanks for your kindly help. > > Yes, I create the keytab by "nfs/nfsv4@PLASMON.SIT" and start rpc.gssd > and rpc.svcgssd successfully. nfsv4 is the hostname of NFS server, and > PLASMON.SIT is the AD domain. For your reference - when working with Kerberos, the "instance" part of the principal name (the part between the "/" and the "@") should be the host's fully-qualified-domain-name (fqdn). So you *should* have a principal, "nfs/nfsv4.plascom.sit@PLASMON.SIT" or something like that. > When Set Windows2K as KDC for NFSv4, is it necessary to user Ktpass > tools to create keytab in the KDC server(Windows), and copy the keytabs > to NFS server and clients? > > If so, it seems to be complicated and causes security problems while > users have to log and access KDC server frequently. > > Is there other easy way to do this? We do not want to make the end-users > confused. There are tools that allow you to create the keytab directly from the NFS server and client machine, one example is described here: http://mailman.mit.edu/pipermail/kerberos/2007-March/011423.html, there are probably others. Otherwise, yes you must create the keytab on the Windows machine and transfer it to the Linux machines. K.C. ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: can not start NFSv4 with Kerberos 5 2007-04-03 11:46 ` William A. (Andy) Adamson 2007-04-03 12:13 ` Phillip @ 2007-04-04 8:43 ` Phillip 2007-04-04 15:47 ` Kevin Coffman 1 sibling, 1 reply; 9+ messages in thread From: Phillip @ 2007-04-04 8:43 UTC (permalink / raw) To: William A. (Andy) Adamson; +Cc: nfs Update, In the NFS v4 server, I could start NFS server successful [root@nfsv4 ~]# service nfs restart Shutting down RPC svcgssd: [ OK ] Shutting down NFS mountd: [ OK ] Shutting down NFS daemon: [ OK ] Shutting down NFS quotas: [ OK ] Shutting down NFS services: [ OK ] Starting RPC svcgssd: [ OK ] Starting NFS services: [ OK ] Starting NFS quotas: [ OK ] Starting NFS daemon: [ OK ] Starting NFS mountd: [ OK ] [root@nfsv4 ~]# rpc.gssd -fvvv Using keytab file '/etc/krb5.keytab' Processing keytab entry for principal 'nfs/nfsv4@PLASMON.SIT' We will use this entry (nfs/nfsv4@PLASMON.SIT) Using (machine) credentials cache: 'FILE:/tmp/krb5cc_machine_PLASMON.SIT' processing client list [root@nfsv4 ~]# cat /etc/exports # /XFS/NFS4 gss/krb5 (fsid=0,insecure,no_root_squash,no_subtree_check) It seems everything runs ok, but also in this NFSv4 server, mount failed: [root@nfsv4 ~]# mount -t nfs4 -o sec=krb5 192.168.123.63:/ /e Warning: rpc.gssd appears not to be running. mount: Broken pipe I find that the rpc.gssd is running: [root@nfsv4 ~]# ps -ef | grep rpc.gss root 5053 4854 0 16:31 pts/2 00:00:00 rpc.gssd -fvvv root 5065 4909 0 16:34 pts/3 00:00:00 grep rpc.gss there's the following lines in /var/log/message: Apr 4 11:11:00 nfsv4 rpc.svcgssd[4742]: WARNING: handle_nullreq: failed parsing request Apr 4 11:11:25 nfsv4 rpc.svcgssd[4742]: WARNING: handle_nullreq: failed parsing request I've searched for many resolutions, however, none can fix my issue. Please give me some hints, thanks in advance. Regards, Phillip On Tue, 2007-04-03 at 07:46 -0400, William A. (Andy) Adamson wrote: > > > On 4/3/07, Phillip <phuang@plasmon.cn> wrote: > Hi folks, > > Currently we plan to use NFSV4 with Kerberos: > KDC: Windows 2K AD > > NFSv4 server: CentOS 4.4 with 2.6.20 kernel > # cat /etc/exports > /XFS/NFS4 gss/krb5 > (rw,fsid=0,insecure,no_root_squash,no_subtree_check,sync) > > Client: CentOS 4.4 > > When I use Ktpass to create keytab: > > C:> Ktpass princ administrator/PLASMON.SIT@PLASMON.SIT mapuser > administrator -pass admin out unixmachine.keytab > C:> Ktpass princ root/PLAMONS.SIT@PLASMON.SIT mapuser root - > pass admin > out unixmachine_1.keytab > > > and copy this output keytabs to NFSv4 server, and then export > them with > kinit well. > > However, when I attempt to start NFS service, the rpcsvcgssd > failed. > > Then I try to execute these below commands > > [root@nfsv4 kevin]# rpc.svcgssd -fvvv > ERROR: GSS-API: error in gss_import_name(): An invalid name > was supplied > - Hostname cannot be canonicalized > unable to obtain root (machine) credentials > do you have a keytab entry for nfs/<your.host>@<YOUR.REALM> > in /etc/krb5.keytab? > > as the error message on the server said: you need a keytab of the > form > > nfs/<your.host>@<YOUR.REALM> > > the root/<your.host>@<YOUR.REALM> or > administrator/<your.host>@<YOUR.REALM> won/t work. > > -->Andy > > > [root@nfsv4 kevin]# rpc.gssd -fvvv > Using keytab file '/etc/krb5.keytab' > Processing keytab entry for principal > 'administrator/PLASMON.SIT@PLASMON.SIT' > We will NOT use this entry > (administrator/PLASMON.SIT@PLASMON.SIT) > Processing keytab entry for principal > 'root/PLASMON.SIT@PLASMON.SIT' > We will NOT use this entry (root/PLASMON.SIT@PLASMON.SIT) > ERROR: No usable keytab entries found in keytab > '/etc/krb5.keytab' > Do you have a valid keytab entry for > nfs/<your.host>@<YOUR.REALM> in > keytab file /etc/krb5.keytab ? > Continuing without (machine) credentials - nfs4 mounts with > Kerberos > will fail > processing client list > > > Did I take mistakes in creating keytab? > > > Please help me fix this issue. > Thanks in advance. > > Regards, > Phillip > > > > > ------------------------------------------------------------------------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the chance > to share your > opinions on IT & business topics through brief surveys-and > earn cash > http://www.techsay.com/default.php? > page=join.php&p=sourceforge&CID=DEVDEV > _______________________________________________ > NFS maillist - NFS@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/nfs > > ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: can not start NFSv4 with Kerberos 5 2007-04-04 8:43 ` Phillip @ 2007-04-04 15:47 ` Kevin Coffman 0 siblings, 0 replies; 9+ messages in thread From: Kevin Coffman @ 2007-04-04 15:47 UTC (permalink / raw) To: Phillip; +Cc: nfs On 4/4/07, Phillip <phuang@plasmon.cn> wrote: > > [root@nfsv4 ~]# mount -t nfs4 -o sec=krb5 192.168.123.63:/ /e > Warning: rpc.gssd appears not to be running. > mount: Broken pipe > > I find that the rpc.gssd is running: > [root@nfsv4 ~]# ps -ef | grep rpc.gss > root 5053 4854 0 16:31 pts/2 00:00:00 rpc.gssd -fvvv > root 5065 4909 0 16:34 pts/3 00:00:00 grep rpc.gss The Warning message is because rpc.gssd was not started from the script which writes the pid file. Not a problem here. > there's the following lines in /var/log/message: > > Apr 4 11:11:00 nfsv4 rpc.svcgssd[4742]: WARNING: handle_nullreq: failed > parsing request > Apr 4 11:11:25 nfsv4 rpc.svcgssd[4742]: WARNING: handle_nullreq: failed > parsing request See if svcgssd with more debugging (-vvv) gives a better clue. Is this a 64-bit machine? What versions of nfs-utils and supporting libraries (libgssapi, librpcsecgss) is this with? K.C. ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2007-04-04 15:47 UTC | newest] Thread overview: 9+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2007-04-03 10:10 can not start NFSv4 with Kerberos 5 Phillip 2007-04-03 11:46 ` William A. (Andy) Adamson 2007-04-03 12:13 ` Phillip 2007-04-03 13:18 ` William A. (Andy) Adamson 2007-04-03 14:21 ` Kevin Coffman 2007-04-04 2:17 ` Phillip 2007-04-04 15:30 ` Kevin Coffman 2007-04-04 8:43 ` Phillip 2007-04-04 15:47 ` Kevin Coffman
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.