krb5 mount with large group membership

DISCUSSION Richard Smits 3 participants 5 messages Jul 14, 2011

Subsystems (2)

NFS client NFS server

lore

Share & tools

lore

Richard Smits

author

2011-07-14 09:30 UTC #0 lore raw

Hello list,

I am running into a problem. Perhaps someone understands what is happening here. I will explain.

I have a Redhat 5.4 client that is accessing a nfs export on a NFS server. (Redhat 6.1)

Our KDC is a Windows AD.

The client is using samba-winbind. If a user is a member of 23 groups or lower, I can access the export. If a user is a member of more groups, the mount fails with a "Permission denied"

mount /data
-bash-3.2$ cd /data
-bash: cd: /data: Permission denied

Thew odd thing is if I try a mount to our Netapp filer with also a krb5 export, there is no problem.

This has to do something with the ticket size in combination with memberships to a large number of groups.

So what must i do to get this Redhat server working with this setup ? It seems that Netapp did something to get this working ?

Does this sound familiar to anyone, or should i provide more information ?

Versions server side :
nfs-utils-1.2.3-7
krb5-workstation-1.9-9

Greetings ... Richard Smits

Assarsson, Emil

2011-07-14 11:14 UTC #1 lore raw

Hi,

Your ticket is probably oversized for the NFS server.
Try set NO_AUTH_DATA_REQUIRED (google msn) on the object holding the servers SPN.

--
Emil Assarsson

Quoted 45 lines

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Richard Smits
Sent: torsdag den 14 juli 2011 11:30
To: [email protected]
Subject: krb5 mount with large group membership
Hello list,
I am running into a problem. Perhaps someone understands what is happening here. I will explain.
I have a Redhat 5.4 client that is accessing a nfs export on a NFS server. (Redhat 6.1)
Our KDC is a Windows AD.
The client is using samba-winbind. If a user is a member of 23 groups or lower, I can access the export. If a user is a member of more groups, the mount fails with a "Permission denied"
mount /data
(quoted diff) +0 -2
-bash-3.2$ cd /data
-bash: cd: /data: Permission denied
Thew odd thing is if I try a mount to our Netapp filer with also a krb5 export, there is no problem.
This has to do something with the ticket size in combination with memberships to a large number of groups.
So what must i do to get this Redhat server working with this setup ? It seems that Netapp did something to get this working ?
Does this sound familiar to anyone, or should i provide more information ?
Versions server side :
nfs-utils-1.2.3-7
krb5-workstation-1.9-9
Greetings ... Richard Smits
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Richard Smits

author

2011-07-14 13:03 UTC #2 lore raw

Hi,

Good tip. Thank you.

note : If I check the "Do not require Kerberos preauthentication" in the AD on my testaccount, it works...

So now i have to look what else this breaks.

Greetings .. Richard

Quoted 53 lines · Emil

Hi,
Your ticket is probably oversized for the NFS server.
Try set NO_AUTH_DATA_REQUIRED (google msn) on the object holding the servers SPN.
--
Emil Assarsson
Quoted 45 lines
-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Richard Smits
Sent: torsdag den 14 juli 2011 11:30
To: [email protected]
Subject: krb5 mount with large group membership
Hello list,
I am running into a problem. Perhaps someone understands what is happening here. I will explain.
I have a Redhat 5.4 client that is accessing a nfs export on a NFS server. (Redhat 6.1)
Our KDC is a Windows AD.
The client is using samba-winbind. If a user is a member of 23 groups or lower, I can access the export. If a user is a member of more groups, the mount fails with a "Permission denied"
mount /data
(quoted diff) +0 -2
-bash-3.2$ cd /data
-bash: cd: /data: Permission denied
Thew odd thing is if I try a mount to our Netapp filer with also a krb5 export, there is no problem.
This has to do something with the ticket size in combination with memberships to a large number of groups.
So what must i do to get this Redhat server working with this setup ? It seems that Netapp did something to get this working ?
Does this sound familiar to anyone, or should i provide more information ?
Versions server side :
nfs-utils-1.2.3-7
krb5-workstation-1.9-9
Greetings ... Richard Smits
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Assarsson, Emil

2011-07-14 13:29 UTC #3 lore raw

Hi,

Pre-authentication errors:

Try to limit the /etc/krb5.conf to use the 3 closest KDC's only.
I'm using winbind and link /etc/krb5.conf to /var/run/samba/smb_krb5/krb5.conf.* (there should be a "locate" module for mit-krb5 but lucid doesn't provide it).

It can be solved with do not require but I think it's better to solve the real problem. --
Emil Assarsson

Quoted 74 lines

-----Original Message-----
From: Richard Smits [mailto:[email protected]]
Sent: torsdag den 14 juli 2011 15:03
To: [email protected]
Cc: Assarsson, Emil
Subject: Re: krb5 mount with large group membership
Hi,
Good tip. Thank you.
note : If I check the "Do not require Kerberos preauthentication" in the AD on my testaccount, it works...
So now i have to look what else this breaks.
Greetings .. Richard
Quoted 4 lines · Emil
Hi,
Your ticket is probably oversized for the NFS server.
Try set NO_AUTH_DATA_REQUIRED (google msn) on the object holding the servers
SPN.
Quoted 6 lines
--
Emil Assarsson
Quoted 2 lines
-----Original Message-----
From: [email protected] [mailto:linux-nfs-
[email protected]]
Quoted 43 lines
Quoted 43 lines
On Behalf Of Richard Smits
Sent: torsdag den 14 juli 2011 11:30
To: [email protected]
Subject: krb5 mount with large group membership
Hello list,
I am running into a problem. Perhaps someone understands what is happening here. I will explain.
I have a Redhat 5.4 client that is accessing a nfs export on a NFS server. (Redhat 6.1)
Our KDC is a Windows AD.
The client is using samba-winbind. If a user is a member of 23 groups or lower, I can access the export. If a user is a member of more groups, the mount fails with a "Permission denied"
mount /data
(quoted diff) +0 -2
-bash-3.2$ cd /data
-bash: cd: /data: Permission denied
Thew odd thing is if I try a mount to our Netapp filer with also a krb5 export, there is no problem.
This has to do something with the ticket size in combination with memberships to a large number of groups.
So what must i do to get this Redhat server working with this setup ? It seems that Netapp did something to get this working ?
Does this sound familiar to anyone, or should i provide more information ?
Versions server side :
nfs-utils-1.2.3-7
krb5-workstation-1.9-9
Greetings ... Richard Smits
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

J. Bruce Fields

2011-07-14 17:25 UTC #4 lore raw

In reply to Assarsson, Emil

Quoted 4 lines · Emil

Hi,
Your ticket is probably oversized for the NFS server.
Try set NO_AUTH_DATA_REQUIRED (google msn) on the object holding the servers SPN.

The server has trouble with init_sec_context tokens that are longer than a few k--I'd have to check the exact limit. (I wonder how big this one is?)

--b.

Quoted 53 lines

--
Emil Assarsson
Quoted 40 lines
-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Richard Smits
Sent: torsdag den 14 juli 2011 11:30
To: [email protected]
Subject: krb5 mount with large group membership
Hello list,
I am running into a problem. Perhaps someone understands what is happening here. I will explain.
I have a Redhat 5.4 client that is accessing a nfs export on a NFS server. (Redhat 6.1)
Our KDC is a Windows AD.
The client is using samba-winbind. If a user is a member of 23 groups or lower, I can access the export. If a user is a member of more groups, the mount fails with a "Permission denied"
mount /data
(quoted diff) +0 -2
-bash-3.2$ cd /data
-bash: cd: /data: Permission denied
Thew odd thing is if I try a mount to our Netapp filer with also a krb5 export, there is no problem.
This has to do something with the ticket size in combination with memberships to a large number of groups.
So what must i do to get this Redhat server working with this setup ? It seems that Netapp did something to get this working ?
Does this sound familiar to anyone, or should i provide more information ?
Versions server side :
nfs-utils-1.2.3-7
krb5-workstation-1.9-9
Quoted 5 lines
Greetings ... Richard Smits
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html