Re: mount hangs in NFS4+Kerberos setup

[steve <steve@steve-ss.com>]

On 02/10/2012 06:41 PM, whats_up@gmx.net wrote:
>
>> Some older kernels do not support strong keys. Try adding:
>> allow_weak_crypto = true
>> to the
>>    [libdefaults]
>> in /etc/krb5.conf
> yes. I painfully (mount only says access denied) found out this already
> and I use allow_weak_crypto to limit to DES. More encryption
> types have been introduced with kernel 2.6.39...
>
> I tried to use kernel 3.2 from squeeze-backports but this introduced new
> errors, thus I decided to try with 2.6 first.
>
>
>> Also it's not recommended to use the pseudo-root fsid=0 method for
>> nfs exports under Linux:
>>    http://wiki.linux-nfs.org/wiki/index.php/Nfsv4_configuration
> hmm, as far as I have understood I have to:
> - export the root folder /exports explicitly beside the "real"
>    exports p.ex. /exports/opt
> - use fsid=0 for the root folder to force version 4 of NFS
>
> What's your suggestion to improve/secure my configuration?
>
> regards
>    knut
Officially, you should not export from a pseudo root. Please see the 
last few lines in the link I sent.
man rpc.gssd(8) adds:
<quote>
Previous versions of
rpc.gssd used only "nfs/*" keys found within the keytab. To be more 
consistent with other implementations, we now look for specific keytab 
entries. The search order for keytabs to be used for "machine 
credentials" is now:
<HOSTNAME>$@<REALM>
root/<hostname>@<REALM>

nfs/<hostname>@<REALM>

host/<hostname>@<REALM>

root/<anyname>@<REALM>

nfs/<anyname>@<REALM>

host/<anyname>@<REALM>
</quote>

I see your setup uses the root principal. If you still get access 
denied, create another keytab with just the machine$ and host/fqdn keys. 
I can remember having to fiddle with nfs-utils and keytabs on openSUSE 
at some stage last year.

If none of this works you can either stick with the old kernel and 
accept he security, get an up to date nfs-utils and see if hat fixes it 
with the DES keys or grab an up to date distro where all this stuff will 
work out of the box.
Cheers,
Steve