can not start NFSv4 with Kerberos 5

Hi folks,

Currently we plan to use NFSV4 with Kerberos:
KDC: Windows 2K AD

NFSv4 server: CentOS 4.4 with 2.6.20 kernel

# cat /etc/exports
/XFS/NFS4       gss/krb5
(rw,fsid=0,insecure,no_root_squash,no_subtree_check,sync)

Client: CentOS 4.4

When I use Ktpass to create keytab:

C:> Ktpass princ administrator/[email protected] mapuser administrator -pass admin out unixmachine.keytab
C:> Ktpass princ root/[email protected] mapuser root -pass admin out unixmachine_1.keytab

and copy this output keytabs to NFSv4 server, and then export them with kinit well.

However, when I attempt to start NFS service, the rpcsvcgssd failed.

Then I try to execute these below commands

[root@nfsv4 kevin]# rpc.svcgssd -fvvv
ERROR: GSS-API: error in gss_import_name(): An invalid name was supplied
- Hostname cannot be canonicalized
unable to obtain root (machine) credentials
do you have a keytab entry for nfs/<your.host>@<YOUR.REALM> in /etc/krb5.keytab?

Using keytab file '/etc/krb5.keytab'
Processing keytab entry for principal 'administrator/[email protected]'
We will NOT use this entry (administrator/[email protected]) Processing keytab entry for principal 'root/[email protected]' We will NOT use this entry (root/[email protected])
ERROR: No usable keytab entries found in keytab '/etc/krb5.keytab' Do you have a valid keytab entry for nfs/<your.host>@<YOUR.REALM> in keytab file /etc/krb5.keytab ?
Continuing without (machine) credentials - nfs4 mounts with Kerberos will fail
processing client list

Did I take mistakes in creating keytab?

Please help me fix this issue.
Thanks in advance.

Regards,
Phillip

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

On 4/3/07, Phillip <[email protected]> wrote:
Hi folks,

Currently we plan to use NFSV4 with Kerberos:
KDC: Windows 2K AD

NFSv4 server: CentOS 4.4 with 2.6.20 kernel
# cat /etc/exports
/XFS/NFS4 gss/krb5
(rw,fsid=0,insecure,no_root_squash,no_subtree_check,sync)

Client: CentOS 4.4

When I use Ktpass to create keytab:

C:> Ktpass princ administrator/[email protected] mapuser administrator -pass admin out unixmachine.keytab C:> Ktpass princ root/[email protected] mapuser root - pass admin
out unixmachine_1.keytab

and copy this output keytabs to NFSv4 server, and then export them with
kinit well.

However, when I attempt to start NFS service, the rpcsvcgssd failed.

Then I try to execute these below commands

[root@nfsv4 kevin]# rpc.svcgssd -fvvv
ERROR: GSS-API: error in gss_import_name(): An invalid name was supplied
- Hostname cannot be canonicalized
unable to obtain root (machine) credentials
do you have a keytab entry for nfs/<your.host>@<YOUR.REALM> in /etc/krb5.keytab?

as the error message on the server said: you need a keytab of the form

nfs/<your.host>@<YOUR.REALM>

the root/<your.host>@<YOUR.REALM> or administrator/<your.host>@<YOUR.REALM> won/t work.

-->Andy

[root@nfsv4 kevin]# rpc.gssd -fvvv
Using keytab file '/etc/krb5.keytab'
Processing keytab entry for principal 'administrator/[email protected]'
We will NOT use this entry (administrator/[email protected]) Processing keytab entry for principal 'root/[email protected]'
We will NOT use this entry (root/[email protected])
ERROR: No usable keytab entries found in keytab '/etc/krb5.keytab'
Do you have a valid keytab entry for nfs/<your.host>@<YOUR.REALM> in
keytab file /etc/krb5.keytab ?
Continuing without (machine) credentials - nfs4 mounts with Kerberos
will fail
processing client list

Did I take mistakes in creating keytab?

Please help me fix this issue.
Thanks in advance.

Regards,
Phillip

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?
page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

Andy,

Thanks for you kindly reply.

As your comment:
nfs/<your.host>@<YOUR.REALM>
and I google the following:
host/hostname@NT-DNS-REALM-NAME

hostname is the host DNS name, for example, foobar.microsoft.com. NT-DNS-REALM-NAME is the uppercase name of the Windows 2000 domain; for example, RESKIT.COM.

1. What does the above term "host" mean? Hostname of NFS server, or service(nfs)?

How could I set the DNS name since I could not operate on the DNS server?

Regards,
Phillip

Quoted 78 lines · William A. (Andy) Adamson

On 4/3/07, Phillip <[email protected]> wrote:
Hi folks,

Currently we plan to use NFSV4 with Kerberos:
KDC: Windows 2K AD

NFSv4 server: CentOS 4.4 with 2.6.20 kernel
# cat /etc/exports
/XFS/NFS4 gss/krb5
(rw,fsid=0,insecure,no_root_squash,no_subtree_check,sync)

Client: CentOS 4.4

When I use Ktpass to create keytab:

C:> Ktpass princ administrator/[email protected] mapuser administrator -pass admin out unixmachine.keytab C:> Ktpass princ root/[email protected] mapuser root - pass admin
out unixmachine_1.keytab

and copy this output keytabs to NFSv4 server, and then export them with
kinit well.

However, when I attempt to start NFS service, the rpcsvcgssd failed.

Then I try to execute these below commands

[root@nfsv4 kevin]# rpc.svcgssd -fvvv
ERROR: GSS-API: error in gss_import_name(): An invalid name was supplied
- Hostname cannot be canonicalized
unable to obtain root (machine) credentials
do you have a keytab entry for nfs/<your.host>@<YOUR.REALM> in /etc/krb5.keytab?

as the error message on the server said: you need a keytab of the form

nfs/<your.host>@<YOUR.REALM>

the root/<your.host>@<YOUR.REALM> or administrator/<your.host>@<YOUR.REALM> won/t work.

-->Andy

[root@nfsv4 kevin]# rpc.gssd -fvvv
Using keytab file '/etc/krb5.keytab'
Processing keytab entry for principal 'administrator/[email protected]'
We will NOT use this entry (administrator/[email protected]) Processing keytab entry for principal 'root/[email protected]'
We will NOT use this entry (root/[email protected])
ERROR: No usable keytab entries found in keytab '/etc/krb5.keytab'
Do you have a valid keytab entry for nfs/<your.host>@<YOUR.REALM> in
keytab file /etc/krb5.keytab ?
Continuing without (machine) credentials - nfs4 mounts with Kerberos
will fail
processing client list

Did I take mistakes in creating keytab?

Please help me fix this issue.
Thanks in advance.

Quoted 7 lines

Regards,
Phillip

-------------------------------------------------------------------------

Quoted 12 lines

Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?
page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

Quoted 4 lines · Phillip

Andy,

Thanks for you kindly reply.

Quoted 8 lines

As your comment:
nfs/<your.host>@<YOUR.REALM>
and I google the following:
host/hostname@NT-DNS-REALM-NAME

hostname is the host DNS name, for example, foobar.microsoft.com. NT-DNS-REALM-NAME is the uppercase name of the Windows 2000 domain; for example, RESKIT.COM.

hostname is the dns name of your host. the realm name is the name of your kerberos domain.

Quoted 3 lines

I have two questions:
1. What does the above term "host" mean? Hostname of NFS server, or service(nfs)?

this is kerberos speak.

a kerberos service name has a "service" component (host, root, nfs, ldap, web, or whatever you want) followed by a "/" and then the dns hostname.

NFSv4 requires that the NFSv4 server Kerberos service name is of the form

nfs/<dnshostname>@<KERBEROS.REALM>

the "host" service name is used by many other servers, but not by NFSv4.

the NFSv4 client keytab name is unspecified. so, if you want you can place a keytab on the client
to be used for NFSv4 - but it is not required.

Quoted 29 lines · William A. (Andy) Adamson

Quoted 4 lines · Phillip

Andy,

Thanks for you kindly reply.

Quoted 8 lines

As your comment:
nfs/<your.host>@<YOUR.REALM>
and I google the following:
host/hostname@NT-DNS-REALM-NAME

hostname is the host DNS name, for example, foobar.microsoft.com. NT-DNS-REALM-NAME is the uppercase name of the Windows 2000 domain; for example, RESKIT.COM.

hostname is the dns name of your host. the realm name is the name of your kerberos domain.

Quoted 3 lines

I have two questions:
1. What does the above term "host" mean? Hostname of NFS server, or service(nfs)?

this is kerberos speak.

a kerberos service name has a "service" component (host, root, nfs, ldap, web, or whatever you want) followed by a "/" and then the dns hostname.

NFSv4 requires that the NFSv4 server Kerberos service name is of the form

Quoted 7 lines

nfs/<dnshostname>@<KERBEROS.REALM>

the "host" service name is used by many other servers, but not by NFSv4.

the NFSv4 client keytab name is unspecified. so, if you want you can place a keytab on the client
to be used for NFSv4 - but it is not required.

Actually, the *current* client code requires a "nfs/*@<KERBEROS.REALM>" key. (This changes in (not yet released) nfs-utils-1.1.0 so that other keys may be used.)

K.C.

Hello Andy & Kevin,

Thanks for your kindly help.

Yes, I create the keytab by "nfs/[email protected]" and start rpc.gssd and rpc.svcgssd successfully. nfsv4 is the hostname of NFS server, and PLASMON.SIT is the AD domain.

When Set Windows2K as KDC for NFSv4, is it necessary to user Ktpass tools to create keytab in the KDC server(Windows), and copy the keytabs to NFS server and clients?

If so, it seems to be complicated and causes security problems while users have to log and access KDC server frequently.

Is there other easy way to do this? We do not want to make the end-users confused.

On 4/3/07, Phillip <[email protected]> wrote:
Hi folks,

Currently we plan to use NFSV4 with Kerberos:
KDC: Windows 2K AD

NFSv4 server: CentOS 4.4 with 2.6.20 kernel
# cat /etc/exports
/XFS/NFS4 gss/krb5
(rw,fsid=0,insecure,no_root_squash,no_subtree_check,sync)

Client: CentOS 4.4

When I use Ktpass to create keytab:

C:> Ktpass princ administrator/[email protected] mapuser administrator -pass admin out unixmachine.keytab C:> Ktpass princ root/[email protected] mapuser root - pass admin
out unixmachine_1.keytab

and copy this output keytabs to NFSv4 server, and then export them with
kinit well.

However, when I attempt to start NFS service, the rpcsvcgssd failed.

Then I try to execute these below commands

[root@nfsv4 kevin]# rpc.svcgssd -fvvv
ERROR: GSS-API: error in gss_import_name(): An invalid name was supplied
- Hostname cannot be canonicalized
unable to obtain root (machine) credentials
do you have a keytab entry for nfs/<your.host>@<YOUR.REALM> in /etc/krb5.keytab?

as the error message on the server said: you need a keytab of the form

nfs/<your.host>@<YOUR.REALM>

the root/<your.host>@<YOUR.REALM> or administrator/<your.host>@<YOUR.REALM> won/t work.

-->Andy

[root@nfsv4 kevin]# rpc.gssd -fvvv
Using keytab file '/etc/krb5.keytab'
Processing keytab entry for principal 'administrator/[email protected]'
We will NOT use this entry (administrator/[email protected]) Processing keytab entry for principal 'root/[email protected]'
We will NOT use this entry (root/[email protected])
ERROR: No usable keytab entries found in keytab '/etc/krb5.keytab'
Do you have a valid keytab entry for nfs/<your.host>@<YOUR.REALM> in
keytab file /etc/krb5.keytab ?
Continuing without (machine) credentials - nfs4 mounts with Kerberos
will fail
processing client list

Did I take mistakes in creating keytab?

Please help me fix this issue.
Thanks in advance.

Regards,
Phillip

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?
page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

[root@nfsv4 ~]# mount -t nfs4 -o sec=krb5 192.168.123.63:/ /e
Warning: rpc.gssd appears not to be running.
mount: Broken pipe

I find that the rpc.gssd is running:
[root@nfsv4 ~]# ps -ef | grep rpc.gss

root      5053  4854  0 16:31 pts/2    00:00:00 rpc.gssd -fvvv
root      5065  4909  0 16:34 pts/3    00:00:00 grep rpc.gss

there's the following lines in /var/log/message:

Apr  4 11:11:00 nfsv4 rpc.svcgssd[4742]: WARNING: handle_nullreq: failed
parsing request
Apr  4 11:11:25 nfsv4 rpc.svcgssd[4742]: WARNING: handle_nullreq: failed

parsing request