Kerberos authentication Problem with nfs3/4
Subsystems (2)
A message that is not in the archive (sent off-list or not yet received): [email protected]
Begin forwarded message:
Quoted 26 lines
From: "J. Bruce Fields" <[email protected]>
Date: October 18, 2008 17:30:37 GMT+02:00
To: Guntsche Michael <mike-Z92qn3yYq0hWk0Htik3J/[email protected]>
Subject: Re: Kerberos authentication Problem with nfs3/4Quoted 11 lines · Guntsche Michael
Quoted 7 lines · Guntsche Michael
Hello list,
I had my kerberised NFS4 and NFS3 setup running in test mode up to the end of April.
After seeing that there have been changes made to the recent code to make NFS3+Kerberos working without sec=sys I tried to mount my exports again with kerberos auth enabled.Quoted 8 lines
Ok, I found the problem. Downgrading libnfsidmap to 0.20 makes the mount succeed, with version 0.21 it does not work. To make sure that this is not due a debian patch I downloaded the pristine source of both versions and checked it again.
According to the AUTHORS Bruce Fields is working on this library, so I will try to contact him to work out why 0.21 is not working on my system.
Quoted 6 lines
[email protected] or [email protected] would be the right place to ask about this.
Is it possible you could be hitting this?:
http://linux-nfs.org/pipermail/nfsv4/2008-October/009365.html
Apparently this never made it to the list, but only to myself and Bruce :)
Coming back to the problem. In my case the domain name and realm are the same. I'll try to find out, where the problem is triggered exactly.
Kind regards,
Michael
A message that is not in the archive (sent off-list or not yet received): 14393409-84DC-42C1-9680-32A2B81A27BA-Z92qn3yYq0hWk0Htik3J/[email protected]
Quoted 5 lines · Guntsche Michael
Quoted 5 lines
[email protected] or [email protected] would be the right place to ask about this.
Quoted 8 lines
Quoted 3 lines
Is it possible you could be hitting this?:
http://linux-nfs.org/pipermail/nfsv4/2008-October/009365.htmlApparently this never made it to the list, but only to myself and Bruce :)
Coming back to the problem. In my case the domain name and realm are the same. I'll try to find out, where the problem is triggered exactly.
Ok, the problem has been solved. It was a configuration error afterall. The problem was that per default this was set in idmapd.conf
Domain = localdomin
The new version if the library read this one first and of course this led to problems. There are two possible solutions here.
* Change the Domain entry in the config file
* Remove the entry, then a DNS lookup is made
In both cases mounting the export with krb5 works without any problems.
Sorry for putting so much noise on the list.
Kind regards,
Michael
A message that is not in the archive (sent off-list or not yet received): 28F249B0-91A5-4EA5-A12E-F6258B240EDB-Z92qn3yYq0hWk0Htik3J/[email protected]
Quoted 28 lines · Guntsche Michael
Quoted 7 lines · Guntsche Michael
Quoted 7 lines
[email protected] or [email protected] would be the right place to ask about this.
Is it possible you could be hitting this?:
Quoted 9 lines
Apparently this never made it to the list, but only to myself and Bruce :)
Coming back to the problem. In my case the domain name and realm are the same. I'll try to find out, where the problem is triggered exactly.
Ok, the problem has been solved. It was a configuration error afterall. The problem was that per default this was set in idmapd.conf
Domain = localdomin
The new version if the library read this one first and of course this led to problems. There are two possible solutions here.
Quoted 6 lines
* Change the Domain entry in the config file
* Remove the entry, then a DNS lookup is madeIn both cases mounting the export with krb5 works without any problems.
Sorry for putting so much noise on the list.
It looks like the most recent commit cfc6246a43... fromgit://git.linux-nfs.org/projects/kwc/libnfsidmap.git sets the default to get the domain from DNS, so hopefully this will be more likely to work out of the box in the future.
--b.