Kerberize NFS

Introduction

http://jurjenbokma.com/ApprenticesNotes/ad_nfs4.html

Setup

Client Machine

net ads join createupn=host/$(hostname -f)@CS.CPSC.UCALGARY.CA -U admin%pass
net ads keytab add nfs/$(hostname -f)@CS.CPSC.UCALGARY.CA -U admin%pass

File Server

net ads keytab add nfs -U admin%pass

Joining Domain

To join a domain as a specific computer, you can pass in

createcomputer='OU=Extra Workstations,OU=Computers,OU=MYDOMAIN,DC=wspace,DC=mydomain,DC=com'

Troubleshooting

mount.nfs4: access dened by server

Attempted to do:

root@cs1:/mnt# mount -t nfs4 -o sec=krb5i file2:/export/home /mnt/test
mount.nfs4: access denied by server while mounting file2:/export/home

rpcgssd -fvvv returns:

dir_notify_handler: sig 37 si 0x7fffc1aa5bb0 data 0x7fffc1aa5a80
dir_notify_handler: sig 37 si 0x7fffc1aa5bb0 data 0x7fffc1aa5a80
dir_notify_handler: sig 37 si 0x7fffc1aa5a70 data 0x7fffc1aa5940
handling gssd upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt1c)
handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 '
handling krb5 upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt1c)
process_krb5_upcall: service is '<null>'
Full hostname for 'file2.cs.cpsc.ucalgary.ca' is 'file2.cs.cpsc.ucalgary.ca'
Full hostname for 'cs1.cs.cpsc.ucalgary.ca' is 'cs1.cs.cpsc.ucalgary.ca'
Success getting keytab entry for 'CS1$@CS.CPSC.UCALGARY.CA'
INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_CS.CPSC.UCALGARY.CA' are good until 1367913056
INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_CS.CPSC.UCALGARY.CA' are good until 1367913056
using FILE:/tmp/krb5cc_machine_CS.CPSC.UCALGARY.CA as credentials cache for machine creds
using environment variable to select krb5 ccache FILE:/tmp/krb5cc_machine_CS.CPSC.UCALGARY.CA
creating context using fsuid 0 (save_uid 0)
creating tcp client for server file2.cs.cpsc.ucalgary.ca
DEBUG: port already set to 2049
creating context with server nfs@file2.cs.cpsc.ucalgary.ca
WARNING: Failed to create krb5 context for user with uid 0 for server file2.cs.cpsc.ucalgary.ca
WARNING: Failed to create machine krb5 context with credentials cache FILE:/tmp/krb5cc_machine_CS.CPSC.UCALGARY.CA for server file2.cs.cpsc.ucalgary.ca
WARNING: Machine cache is prematurely expired or corrupted trying to recreate cache for server file2.cs.cpsc.ucalgary.ca
Full hostname for 'file2.cs.cpsc.ucalgary.ca' is 'file2.cs.cpsc.ucalgary.ca'
Full hostname for 'cs1.cs.cpsc.ucalgary.ca' is 'cs1.cs.cpsc.ucalgary.ca'
Success getting keytab entry for 'CS1$@CS.CPSC.UCALGARY.CA'
INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_CS.CPSC.UCALGARY.CA' are good until 1367913056
INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_CS.CPSC.UCALGARY.CA' are good until 1367913056
using FILE:/tmp/krb5cc_machine_CS.CPSC.UCALGARY.CA as credentials cache for machine creds
using environment variable to select krb5 ccache FILE:/tmp/krb5cc_machine_CS.CPSC.UCALGARY.CA
creating context using fsuid 0 (save_uid 0)
creating tcp client for server file2.cs.cpsc.ucalgary.ca
DEBUG: port already set to 2049
creating context with server nfs@file2.cs.cpsc.ucalgary.ca
WARNING: Failed to create krb5 context for user with uid 0 for server file2.cs.cpsc.ucalgary.ca
WARNING: Failed to create machine krb5 context with credentials cache FILE:/tmp/krb5cc_machine_CS.CPSC.UCALGARY.CA for server file2.cs.cpsc.ucalgary.ca
WARNING: Failed to create machine krb5 context with any credentials cache for server file2.cs.cpsc.ucalgary.ca
doing error downcall
dir_notify_handler: sig 37 si 0x7fffc1aa5bb0 data 0x7fffc1aa5a80
dir_notify_handler: sig 37 si 0x7fffc1aa5bb0 data 0x7fffc1aa5a80
dir_notify_handler: sig 37 si 0x7fffc1aa1470 data 0x7fffc1aa1340
dir_notify_handler: sig 37 si 0x7fffc1aa5ab0 data 0x7fffc1aa5980
dir_notify_handler: sig 37 si 0x7fffc1aa5ab0 data 0x7fffc1aa5980
dir_notify_handler: sig 37 si 0x7fffc1aa1470 data 0x7fffc1aa1340
dir_notify_handler: sig 37 si 0x7fffc1aa1470 data 0x7fffc1aa1340
destroying client /var/lib/nfs/rpc_pipefs/nfs/clnt1d
destroying client /var/lib/nfs/rpc_pipefs/nfs/clnt1c