Re: linux / automount not respecting sec=sys parameter when NFS server supports sys:krb5

[Richard Smits <R.Smits@tudelft.nl>]

Myles Uyema wrote:
> We have a Netapp filer (8.0.1) exporting NFSv3 homedirs with -sec=sys:krb5,rw

This is interesting. Are you making an export on a Netapp filer that is
"sec=sys" AND "sec=krb5" ? (sys:krb5)

In my experience this doesn't work and you can only make a "sec=sys"
export OR a "sec=krb5" on the same directory/qtree.

Can you please clarify this ?

Greetings .. Richard Smits

> We have automount using LDAP for homedir mounts, explicitly specifying
> sec=sys for all users, except for the krb5 beta testers.
> 
> We are rolling out users with kerberos slowly across our linux
> machines. However, when a krb5 beta tester accessing any homedir,
> Linux and automount will choose to mount that homedir using sec=krb5.
> It's quite apparent that /etc/mtab shows the mount parameter as
> sec=sys, but /proc/mounts shows the same mount as sec=krb5
> 
> /etc/mtab
> nfstest101:/vol/krbtest01/testuser /home/testuser nfs
> rw,hard,intr,sec=sys,addr=10.21.127.101 0 0
> 
> /proc/mounts
> nfstest101:/vol/krbtest01/testuser /home/testuser nfs
> rw,vers=3,rsize=65536,wsize=65536,hard,intr,proto=tcp,timeo=600,retrans=2,sec=krb5,addr=10.21.127.101
> 0 0
> 
> If testuser then logs in (without a kerberos ticket) they cannot
> access their own home directory.
> 
> Why is linux/automount ignoring our explicit sec=sys parameter?
> 
> Linux 2.6.20 kernel CentOS 5.x
> Autofs 5.0.1
> mount (util-linux 2.13-pre7)
> MIT-Kerberos 5
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html