From: Jonathan Schreiter <jonathanschreiter@yahoo.com>
To: nfs@lists.sourceforge.net
Subject: Re: nfs4 with kerberos troubles
Date: Thu, 15 Mar 2007 04:05:18 -0700 (PDT) [thread overview]
Message-ID: <943870.52524.qm@web34415.mail.mud.yahoo.com> (raw)
Sorry, I noticed a typo, the client kerberos keyfile has:
client:
nfs/myclient.mydomain.com@MYREALM.COM
host/myclient.mydomain.com@MYREALM.COM
Jonathan
----- Original Message ----
From: Jonathan Schreiter <jonathanschreiter@yahoo.com>
To: nfs@lists.sourceforge.net
Sent: Wednesday, March 14, 2007 11:15:05 PM
Subject: [NFS] nfs4 with kerberos troubles
Hi all,
I've been strugling to get NFS4 to work with my MIT Kerberos 5 infrastucture. I have a server and client with Centos 4.4. I'm using LDAP (Fedora Directory Server 1.4) for my POSIX accounts and KRB5 for the authentication. I am able to get the NFS mounts to work when kerberos is not enabled.
The error from the mount command # mount -t nfs4 -o sec=krb5 mynfsserver:/ /home/NFS4 is:
Warning: rpc.gssd appears not to be running.
mount: block device mynfsserver:/ is write-protected, mounting read-only
mount: cannot mount block device mynfsserver:/ read-only
When I run rpc.gssd -f vvvvvvv from the client, the error I'm seeing is:
WARNING: Failed to create krb5 context for user with uid 0 with any credentials cache for server mynfsserver.mydomain.com
On the server, in /var/log/messages:
mountd[2517]: mount request from unknown host myclientipaddress for /home/NFS4 (/home/NFS4)
I've got portmap, rpcidmapd, nfs, rpcgssd, and rpcsvcgssd services running on both client and server (but I'm not sure all are required on both).
I have created a host and nfs principal and have ktadded them to both the client and server:
#ktlist -k /etc/krb5.keytab
server:
nfs/myserver.mydomain.com@MYREALM.COM
host/myserver.mydomain.com@MYREALM.COM
client:
nfs/myclient.mydomain.com@MYREALM.COM
host/myserver.mydomain.com@MYREALM.COM
note: mydomain.com = MYREALM.COM (but realm is all uppercase)
I only found one other post referencing this, but it recommended the error be in the /etc/krb5.conf. I have:
.mydomain.com = MYREALM.COM
mydomain.com = MYREALM.COM
.mydomain.com = myrealm.com
I've also turned off nfslock and iptables services (latter for testing).
nfs server:
-----------
/etc/exports
/home/NFS4 gss/krb5(rw,fsid=0,insecure,no_subtree_check)
/etc/fstab:
/dev/VolGroup00/LogVol02 /home ext3 rw,acl 1 2
/etc/sysconfig/nfs
SECURE_NFS=yes
RPCNFSDCOUNT=8
/etc/idmapd.conf
Pipefs-Directory = /var/lib/nfs/rpc_pipefs
Domain = mydomain.com
Nobody-User = nfsnobody
Nobody-Group = nfsnobody
Method = nsswitch
nfs client:
-----------
/etc/sysconfig/nfs
SECURE_NFS=yes
RPCNFSDCOUNT=8
/etc/idmapd.conf
Pipefs-Directory = /var/lib/nfs/rpc_pipefs
Domain = mydomain.com
Nobody-User = nfsnobody
Nobody-Group = nfsnobody
Method = nsswitch
Can anyone please point me in the correct direction?
Many thanks!
Jonathan
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
NFS maillist - NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
NFS maillist - NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs
next reply other threads:[~2007-03-15 11:05 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-03-15 11:05 Jonathan Schreiter [this message]
-- strict thread matches above, loose matches on Subject: below --
2007-03-16 1:52 nfs4 with kerberos troubles Jonathan Schreiter
2007-03-15 21:41 Jonathan Schreiter
2007-03-15 22:32 ` Kevin Coffman
2007-03-15 3:15 Jonathan Schreiter
2007-03-15 14:04 ` Kevin Coffman
2007-03-15 14:06 ` Kevin Coffman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=943870.52524.qm@web34415.mail.mud.yahoo.com \
--to=jonathanschreiter@yahoo.com \
--cc=nfs@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox