NFS IO on kerberized export failing with permission denied error
parinay
parinay at gmail.com
Tue Apr 15 07:15:34 EDT 2008
Hi,
Can anybody help in this please?
- All machines in talk are in time sync
- All machines are reachable with their FQDN
- Kinit/kadmin –p to KDC server is working fine. So I guess there
is no problem in these two i.e. KDC client and KDC sever though I could be
wrong here
- I am not able to understand what's the problem here, as the
princiapal/keytab for filer is in place.
*Apr 15 06:09:15 kc4b1-e0 rpc.gssd[373]: ERROR: can't open clnt54: No such
file or directory *
* *
*Apr 15 06:09:15 kc4b1-e0 rpc.gssd[373]: WARNING: Failed to obtain machine
credentials for connection to server
rtpqa-fas6080-7-e0b.nas.ssqa.rtp.netapp.com *
Thanks & regards
Parinay
Logs to better explain my problem
*Linux Client*
[root at kc4b1-e0 ~]# uname -a
Linux kc4b1-e0 2.6.18-8.1.3.el5 #1 SMP Mon Apr 16 15:54:14 EDT 2007 x86_64
x86_64 x86_64 GNU/Linux
[root at kc4b1-e0 ~]#
* *
*CLIENT KEYTAB*
[root at kc4b1-e0 ~]# klist -k
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
----
--------------------------------------------------------------------------
3 root/kc4b1-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
3 nfs/kc4b1-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
[root at kc4b1-e0 ~]# kinit
Password for root/admin at NAS.SSQA.RTP.NETAPP.COM:
[root at kc4b1-e0 ~]#
[root at kc4b1-e0 ~]# mount -o sec=krb5
rtpqa-fas6080-7-e0b.nas.ssqa.rtp.netapp.com:/vol/vol1/ /mnt/
[root at kc4b1-e0 ~]# cd /mnt/
-bash: cd: /mnt/: Permission denied
[root at kc4b1-e0 ~]# tail /var/log/messages
Apr 15 06:09:15 kc4b1-e0 rpc.gssd[373]: ERROR: can't open clnt54: No such
file or directory
*Apr 15 06:09:15 kc4b1-e0 rpc.gssd[373]: WARNING: Failed to obtain machine
credentials for connection to server
rtpqa-fas6080-7-e0b.nas.ssqa.rtp.netapp.com *
[root at kc4b1-e0 ~]#
*NETAPP Filer keytab*
[root at kc1b8-e0 ~]# klist -k /tmp/6080.keytab
Keytab name: FILE:/tmp/6080.keytab
KVNO Principal
----
--------------------------------------------------------------------------
3 nfs/rtpqa-fas6080-7.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
3 nfs/rtpqa-fas6080-7-e0b.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
[root at kc1b8-e0 ~]#
*NETAPP Filer kerb options*
options nfs.kerb
nfs.kerberos.enable on
nfs.kerberos.file_keytab.enable off
options kerb
kerberos.file_keytab.enable off
kerberos.file_keytab.principal rtpqa-fas6080-7-e0b.nas.ssqa.rtp.netapp.com
kerberos.file_keytab.realm NAS.SSQA.RTP.NETAPP.COM
kerberos.replay_cache.enable off
*NFS SERVER Exports*
/vol/vol1 -sec=krb5,rw,anon=0
*KDC*
[root at kc1b8-e0 ~]# uname -a
Linux kc1b8-e0 2.6.18-8.1.3.el5 #1 SMP Mon Apr 16 15:54:14 EDT 2007 x86_64
x86_64 x86_64 GNU/Linux
[root at kc1b8-e0 ~]#
On Mon, Apr 14, 2008 at 3:56 PM, parinay <parinay at gmail.com> wrote:
> Hi,
>
> I am failing to do NFS io on a volume with sec=krb5. The logs are below,
> to give you an exact idea.
>
> -All clients and KDC are in time sync
>
> -Every machine is reachable with hostname.
>
> -kinit/kadmin works from client
>
> -mount works but cd/ls fails on mounted path
>
> -KDC -2.6.18-8.1.3.el5
>
> -client-SunOS kc1b6 5.10 Generic_118855-33 i86pc i386 i86pc
>
> -NFS exports from - Netapp filer
>
>
> exportfs
> /vol/vol1 -sec=krb5,rw,anon=0
>
> options nfs.kerb
> nfs.kerberos.enable on
> nfs.kerberos.file_keytab.enable on
> nfs.kerberos.principal rtpqa-fas6080-7.rtp.netapp.com
> nfs.kerberos.realm NAS.SSQA.RTP.NETAPP.COM
> options kerb
> kerberos.file_keytab.enable on
> kerberos.file_keytab.principal rtpqa-fas6080-7.rtp.netapp.com
> kerberos.file_keytab.realm NAS.SSQA.RTP.NETAPP.COM
> kerberos.replay_cache.enable off
>
> kadmin.local
> Authenticating as principal root/admin at NAS.SSQA.RTP.NETAPP.COM with
> password.
> kadmin.local: listprincs
> K/M at NAS.SSQA.RTP.NETAPP.COM
> changepw/kc1b8-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> kadmin/admin at NAS.SSQA.RTP.NETAPP.COM
> kadmin/changepw at NAS.SSQA.RTP.NETAPP.COM
> kadmin/history at NAS.SSQA.RTP.NETAPP.COM
> kadmin/kc1b8-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> kiprop/kc1b8-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> krbtgt/NAS.SSQA.RTP.NETAPP.COM at NAS.SSQA.RTP.NETAPP.COM
> nfs/kc1b6-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> nfs/rtpqa-fas3170-9-vif1.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> nfs/rtpqa-fas6080-7.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> parinay/admin at NAS.SSQA.RTP.NETAPP.COM
> parinay/kc1b6-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> root/admin at NAS.SSQA.RTP.NETAPP.COM
> root/kc1b6-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> kadmin.local:
>
> klist -k /tmp/6080.keytab
> Keytab name: FILE:/tmp/6080.keytab
> KVNO Principal
> ----
> --------------------------------------------------------------------------
> 3 nfs/rtpqa-fas6080-7.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> # klist -k /tmp/kc1b6.keytab
> Keytab name: FILE:/tmp/kc1b6.keytab
> KVNO Principal
> ----
> --------------------------------------------------------------------------
> 3 root/kc1b6-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> 3 parinay/kc1b6-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
> 3 nfs/kc1b6-e0.nas.ssqa.rtp.netapp.com at NAS.SSQA.RTP.NETAPP.COM
>
> bash-3.00# cd /mnt/krb
> bash: cd: /mnt/krb: Permission denied
> bash-3.00#mount
>
> /mnt/krb on rtpqa-fas6080-7:/vol/vol1
> remote/read/write/setuid/devices/vers=3/sec=krb5/xattr/dev=4700013 on Mon
> Apr 14 05:34:27 2008
>
>
> --
> easy is right
> begin right and you're easy
> continue easy and you're right
> the right way to go easy is to forget the right way
> and forget that the going is easy....
>
--
easy is right
begin right and you're easy
continue easy and you're right
the right way to go easy is to forget the right way
and forget that the going is easy....
More information about the Kerberos
mailing list