Configuring NFSv4.0 Kerberos on a multi-homed Linux NFS server

[Chuck Lever <chuck.lever@oracle.com>]

Hi-

I have a Linux NFS server with two IP addresses:

192.168.1.55: klimt.home
10.0.0.5: klimt-ib.home

The server's keytab lists three principals:

host/klimt.home@HOME.EXAMPLE.NET
nfs/klimt.home@HOME.EXAMPLE.NET
nfs/klimt-ib.home@HOME.EXAMPLE.NET

When I mount with this:

  vers=4.0,proto=tcp,sec=sys klimt:/export

I get krb5i for lease management, and sys for data traffic.
Callback traffic from the server uses krb5i. All well and
good.

When I mount with this:

  vers=4.0,proto=tcp,sec=sys klimt-ib:/export

I get krb5i for lease management and sys for data traffic
as before, and callback traffic attempts to use krb5i.
But the client rejects all CB_COMPOUND operations because
the callback principal does not match the clp.

Looks like the server always uses the nfs/klimt service
principal for callback traffic? Is there a way to config
the server to use the principal that matches the
interface? Or is there something else going on?

--
Chuck Lever