Re: nfs4 keytabs [was:Re: where can I ask user qns about nfs4]?

[steve <steve@xxxxxxxxxxxx>]

On 02/02/2012 07:57 PM, Tigran Mkrtchyan wrote:
> On Thu, Feb 2, 2012 at 3:56 PM, steve<steve@xxxxxxxxxxxx>  wrote:
> > On 02/02/12 14:29, steve wrote:
> > > On 02/02/2012 02:05 PM, Tigran Mkrtchyan wrote:
> > > > On Thu, Feb 2, 2012 at 12:33 PM, steve<steve@xxxxxxxxxxxx>    wrote:
> > > > > On 02/02/12 11:58, Tigran Mkrtchyan wrote:
> > > > > > Hi Steve,
> > > > > >
> > > > > > > I already use nfs4 to serve my Linux clients. I'm going to kerberize
> > > > > > > it.
> > > > > > > My
> > > > > > > clients already have machine and host principals. What else do they
> > > > > > > need?
> > > > > > >
> > > > > > > 1. nfs/client.domain.name
> > > > > > > 2. nfs/server.domain/name
> > > > > > > 3. neither
> > > > > > > 4. both
> > > > > > We run kerberized NFS.
> > > > > >
> > > > > > our keytab contains:
> > > > > >
> > > > > > on server;
> > > > > >    nfs/server.domain
> > > > > >
> > > > > > on client:
> > > > > >    nfs/client.domain
> > > > > >
> > > > > > and, of course, you need a consistent  idmap configuration.
> > > > > >
> > > > > > Tigran.
> > > > > Hi Tigran
> > > > >
> > > > > That's what we have on our test lan at the moment. I can understand that
> > > > > the
> > > > > server would need the service principal:
> > > > >    nfs/server.domain
> > > > > but not the client, as it's not offering any kerberized service.
> > > > The mount step happens on behalf of host as there are no user requests
> > > > yet.
> > > > Client host credentials are used at that time.
> > > >
> > > > > As an experiment, I removed the nfs/client.domain from a client keytab,
> > > > > rebooted and remounted the share. We could still access the kerberized
> > > > > nfs
> > > > > share. Maybe there were still some tickets left somewhere? That has me
> > > > > really confused.
> > > > Huh! did you enforce kerberos in /etc/exports?
> > > Yes. /etc/exports exports as gss/krb5
> > > I made a screenshot:
> > >
> > >
> > > http://3.bp.blogspot.com/-g40b11Ys_DA/TypYtlO-ixI/AAAAAAAAAIc/cZdeRhnVuY4/s1600/s4all.png
> > >
> > > That's why I'm confused.
> > > Steve
> >
> > Digging a bit further, here is the output of mount on the client:
> > http://dl.dropbox.com/u/45150875/krb5testnfs.png
> >
> > And this appears immediately after the mount:
> > http://dl.dropbox.com/u/45150875/krb5nfstmp.png
> >
> > Most of the documentation tells you to stick nfs into the client keytab as
> > well as the server keytab, but here, I only have the principal on the
> > server.
> >
> > What am I missing?
> I think client simply falls back to 'host' if nfs entry is not available.
>
> Tigran.
I completely cleared /tmp and stuck nfs/client back in the client keytab 
to see if it made any difference. It still wasn't used. I got exactly 
the same tickets as above. It looks as though this is a recent change to 
nfs-utils. I think this post explains why I see nfs being authenticated 
not by the /nfs/client nor /host/client but by the client$ principal.
https://fedorahosted.org/pipermail/sssd-devel/2010-August/004332.html
I'm new to all this so nothing is certain for me the moment!
Does this make sense?
Cheers,
Steve

--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html