NFS+krb5 ID mapping always maps to nobody

NFS+krb5 ID mapping always maps to nobody

[Malte Zacharias]

Hello,

I have been trying to configure an nfsv4 client and server for my
network for some time now, but there is one issue I can't resolve.

I run a small (2-5 clients) network using .local as a domain suffix and
for mDNS resolution. For "historical" reasons, my Kerberos Realm is
TADPOLE. I setup an NFSv4 server and Client that uses Kerberos for
authentication.

My problem is that everytime my client accesses the server, its ID is
mapped to nobody, but I can't find any reason as to why this is
happening. I verified this by creating a file via NFS and it always is
created under user nobody. Test scenarios were:
 - Identical usernames, different UIDs
 - Identical usernames, Identical groupnames, Identical UIDs/GIDs

The result is always the same, the NFS client can only access files with
permissions set to 777. New files, created by the client are created
under user nobody.

My idmap.conf is as follows: (identical on both server and client)
===============================================
[General]

Verbosity = 0
Pipefs-Directory = /var/lib/nfs/rpc_pipefs

Domain = local

[Mapping]

Nobody-User = nobody
Nobody-Group = nogroup
===============================================

my /etc/fstab entry is this:
# NFS mount
iris.local:/	/mnt/nfs	nfs4		defaults,noauto,user,sec=krb5p	0 0

This is a sample command sequence for my problem:
/mnt/nfs/heap is writeable by everyone, /mnt/nfs/nfstest01 only by
nfstest01:
===============================================
nfstest01@desktop:/$ touch /mnt/nfs/heap/test
nfstest01@desktop:/$ touch /mnt/nfs/nfstest01/test
touch: cannot touch `/mnt/nfs/nfstest01/test': Permission denied
nfstest01@desktop:/$ ls -l /mnt/nfs/heap/test
-rw-r--r-- 1 nobody nogroup 0 2010-09-26 00:02 /mnt/nfs/heap/test
nfstest01@desktop:/$ ls -l /mnt/nfs/
drwxr-xrwx  8 malte     users     8192 2010-09-26 00:02 heap
drwxr-x---  2 nfstest01 nfstest01 4096 2010-09-25 22:34 nfstest01
nfstest01@desktop:/$ id
uid=4321(nfstest01) gid=4321(nfstest01) groups=4321(nfstest01)

===============================================

This is what rpc.idmapd -f -vvvvv shows:
===========Server==============================
rpc.idmapd: libnfsidmap: using domain: local
rpc.idmapd: libnfsidmap: loaded plugin /usr/lib/libnfsidmap/nsswitch.so
for method nsswitch
rpc.idmapd: Expiration time is 600 seconds.
rpc.idmapd: Opened /proc/net/rpc/nfs4.nametoid/channel
rpc.idmapd: Opened /proc/net/rpc/nfs4.idtoname/channel
rpc.idmapd: nfsdcb: authbuf=gss/krb5p authtype=user
rpc.idmapd: nfs4_uid_to_name: calling nsswitch->uid_to_name

rpc.idmapd: nfs4_uid_to_name: nsswitch->uid_to_name returned 0

rpc.idmapd: nfs4_uid_to_name: final return value is 0

rpc.idmapd:  Server: (user) id "5555" -> name "malte@local"
rpc.idmapd: nfsdcb: authbuf=gss/krb5p authtype=group
rpc.idmapd: nfs4_gid_to_name: calling nsswitch->gid_to_name

rpc.idmapd: nfs4_gid_to_name: nsswitch->gid_to_name returned 0

rpc.idmapd: nfs4_gid_to_name: final return value is 0

rpc.idmapd:  Server: (group) id "100" -> name "users@local"
rpc.idmapd: nfsdcb: authbuf=gss/krb5p authtype=user
rpc.idmapd: nfs4_uid_to_name: calling nsswitch->uid_to_name

rpc.idmapd: nfs4_uid_to_name: nsswitch->uid_to_name returned 0

rpc.idmapd: nfs4_uid_to_name: final return value is 0

rpc.idmapd:  Server: (user) id "65534" -> name "nobody@local"
rpc.idmapd: nfsdcb: authbuf=gss/krb5p authtype=group
rpc.idmapd: nfs4_gid_to_name: calling nsswitch->gid_to_name

rpc.idmapd: nfs4_gid_to_name: nsswitch->gid_to_name returned 0

rpc.idmapd: nfs4_gid_to_name: final return value is 0

rpc.idmapd:  Server: (group) id "65534" -> name "nogroup@local"
rpc.idmapd: nfsdcb: authbuf=gss/krb5p authtype=user
rpc.idmapd: nfs4_uid_to_name: calling nsswitch->uid_to_name

rpc.idmapd: nfs4_uid_to_name: nsswitch->uid_to_name returned 0

rpc.idmapd: nfs4_uid_to_name: final return value is 0

rpc.idmapd:  Server: (user) id "4321" -> name "nfstest01@local"
===============================================

===========Client==============================
pc.idmapd: libnfsidmap: using domain: local

rpc.idmapd: libnfsidmap: loaded plugin /usr/lib/libnfsidmap/nsswitch.so
for method nsswitch

rpc.idmapd: Expiration time is 600 seconds.
rpc.idmapd: Opened /proc/net/rpc/nfs4.nametoid/channel
rpc.idmapd: Opened /proc/net/rpc/nfs4.idtoname/channel
rpc.idmapd: New client: 0
rpc.idmapd: Opened /var/lib/nfs/rpc_pipefs/nfs/clnt0/idmap
rpc.idmapd: New client: 1
rpc.idmapd: New client: 2
rpc.idmapd: New client: 3
rpc.idmapd: New client: 4
===============================================

I have spent days without any luck resolving this nor finding any
documentation about this point. Nearly every NFSv4 Howto I found so far
just skips Kerberos completely. I think this should definitely work, but
as it appears it doesn't. Additionally all debug output I got so far
wasn't helpful at all, how can I proceed? What further information do
you need?

Best regards
Malte Zacharas

Re: NFS+krb5 ID mapping always maps to nobody

[J. Bruce Fields]

On Sun, Sep 26, 2010 at 12:07:55AM +0200, Malte Zacharias wrote:
> Hello,
> 
> I have been trying to configure an nfsv4 client and server for my
> network for some time now, but there is one issue I can't resolve.
> 
> I run a small (2-5 clients) network using .local as a domain suffix and
> for mDNS resolution. For "historical" reasons, my Kerberos Realm is
> TADPOLE. I setup an NFSv4 server and Client that uses Kerberos for
> authentication.
> 
> My problem is that everytime my client accesses the server, its ID is
> mapped to nobody, but I can't find any reason as to why this is
> happening. I verified this by creating a file via NFS and it always is
> created under user nobody. Test scenarios were:
>  - Identical usernames, different UIDs
>  - Identical usernames, Identical groupnames, Identical UIDs/GIDs

If you're using kerberos then it's the kerberos principal name->uid
mapping that matters here.

So:

> This is a sample command sequence for my problem:
> /mnt/nfs/heap is writeable by everyone, /mnt/nfs/nfstest01 only by
> nfstest01:
> ===============================================
> nfstest01@desktop:/$ touch /mnt/nfs/heap/test
> nfstest01@desktop:/$ touch /mnt/nfs/nfstest01/test
> touch: cannot touch `/mnt/nfs/nfstest01/test': Permission denied
> nfstest01@desktop:/$ ls -l /mnt/nfs/heap/test
> -rw-r--r-- 1 nobody nogroup 0 2010-09-26 00:02 /mnt/nfs/heap/test
> nfstest01@desktop:/$ ls -l /mnt/nfs/
> drwxr-xrwx  8 malte     users     8192 2010-09-26 00:02 heap
> drwxr-x---  2 nfstest01 nfstest01 4096 2010-09-25 22:34 nfstest01
> nfstest01@desktop:/$ id
> uid=4321(nfstest01) gid=4321(nfstest01) groups=4321(nfstest01)
> 
> ===============================================

who did you kinit as before doing this?  (What does klist say?)

--b.

Re: NFS+krb5 ID mapping always maps to nobody

[Malte Zacharias]

> If you're using kerberos then it's the kerberos principal name->uid
> mapping that matters here.
> 
> So:
> 
>> [...]
>
> who did you kinit as before doing this?  (What does klist say?)

I kinit'ed as nfstest01@TADPOLE (my domain is .local, while the realm is
TADPOLE, can this be a cause of the problem?)

I repeated the same test with rpc.idmapd configured to use domain
TADPOLE, results where the same. Unfortunately I found no log mentioning
the principal used.

===============================================
nfstest01@desktop:/mnt/nfs$ klist
Ticket cache: FILE:/tmp/krb5cc_4321_CWpZhW
Default principal: nfstest01@TADPOLE

Valid starting     Expires            Service principal
09/27/10 19:42:07  09/28/10 19:42:07  krbtgt/TADPOLE@TADPOLE
	renew until 09/27/10 19:42:07
nfstest01@desktop:/mnt/nfs$ ls -l
total 8
drwxrwxrwx 2 root      root      4096 2010-07-04 16:00 heap
drwxr-x--- 2 nfstest01 nfstest01 4096 2010-09-25 22:34 nfstest01
nfstest01@desktop:/mnt/nfs$ touch heap/test
nfstest01@desktop:/mnt/nfs$ touch nfstest01/test
touch: cannot touch `nfstest01/test': Permission denied
nfstest01@desktop:/mnt/nfs$ klist
Ticket cache: FILE:/tmp/krb5cc_4321_CWpZhW
Default principal: nfstest01@TADPOLE

Valid starting     Expires            Service principal
09/27/10 19:42:07  09/28/10 19:42:07  krbtgt/TADPOLE@TADPOLE
	renew until 09/27/10 19:42:07
09/27/10 19:42:25  09/28/10 19:42:07  nfs/iris.local@TADPOLE
	renew until 09/27/10 19:42:07
===============================================


I verified that the user nfstest01 exists on both systems in the
respective /etc/passwd files.

Best Regards
Malte Zacharias