Troubles with Kerberized NFS: Solaris8-client to Solaris8-server

[Mikhail T.]

Hello!

I'm struggling to make kerberized NFS working here. My "guinea pigs" are
the following three machines:

   1. apdevl.example.com running Solaris 8 -- this is the NFS-server
   2. ws-mt.example.com running Linux RHEL-5.4 -- this is a Linux NFS-client
   3. apdevl3.example.com running Solaris 8 -- this is the NFS-client

The mounts have already succeeded:

    Linux:
    apdevl:/krbexport on /mnt type nfs (rw,intr,sec=krb5,addr=xx.xx.223.40)
    Solaris:
    /mnt on apdevl:/krbexport
    remote/read/write/setuid/sec=krb5/intr/dev=4e8014b on Tue Dec  1
    17:00:39 2009

On Linux I can access the mounted tree with a valid ticket -- this
works, and makes me think, the NFS-server is configured properly.
However, whatever I do on the Solaris-client, I can not get to read
access the share: permission denied.

gssd, which is started on the Solaris client from inetd, reports the
following to truss, whenever I try to `ls -d /mnt':

    open("/tmp/krb5cc_18039", O_RDONLY)             = 5
    fcntl(5, F_SETLKW, 0xFFBEEE44)                  = 0
    read(5, "0504", 2)                              = 2
    read(5, "\0\f", 2)                              = 2
    read(5, "\001", 2)                              = 2
    read(5, "\0\b", 2)                              = 2
    read(5, "FFFFFFFC\0\0\0\0", 8)                  = 8
    lseek(5, 51, SEEK_SET)                          = 51
    read(5, "\0\0\001", 4)                          = 4
    read(5, "\0\0\001", 4)                          = 4
    read(5, "\0\0\0\v", 4)                          = 4
    read(5, " E X A M P L E . C O M", 11)           = 11
    ...
    close(5)                                        = 0
    fstat(3, 0xFFBEF5E8)                            = 0
    putpmsg(3, 0xFFBEF774, 0xFFBEF760, 0, 0x0004)   = 0
    fstat(3, 0xFFBEF750)                            = 0
    getmsg(3, 0xFFBEF8FC, 0xFFBEF8EC, 0xFFBEF92C)   Err#11 EAGAIN

So, after opening by ticket (18039 is my UID here) and reading it, it
tries to send a message somewhere and fails with EAGAIN...

Trying to snoop the network traffic:

    % snoop -r rpc nfs

I don't get ANYTHING captured in response to my attempts to simply list
the mounted share.
So, it would seem, something is failing locally on the Solaris-client.
What could it be? My ticket-cachenothing but a single, non-expired
krbtgt/EXAMPLE.COM at EXAMPLE.COM

The Solaris client's keytab reads:

    Keytab name: WRFILE:/etc/krb5.keytab
    KVNO Principal
    ----
    --------------------------------------------------------------------------
       5 host/apdevl3.example.com at EXAMPLE.COM (AES-256 CTS mode with
    96-bit SHA-1 HMAC)
       5 host/apdevl3.example.com at EXAMPLE.COM (AES-128 CTS mode with
    96-bit SHA-1 HMAC)
       5 host/apdevl3.example.com at EXAMPLE.COM (Triple DES cbc mode with
    HMAC/sha1)
       5 host/apdevl3.example.com at EXAMPLE.COM (ArcFour with HMAC/md5)
       5 host/apdevl3.example.com at EXAMPLE.COM (DES cbc mode with CRC-32)
       5 root/apdevl3.example.com at EXAMPLE.COM (AES-256 CTS mode with
    96-bit SHA-1 HMAC)
       5 root/apdevl3.example.com at EXAMPLE.COM (AES-128 CTS mode with
    96-bit SHA-1 HMAC)
       5 root/apdevl3.example.com at EXAMPLE.COM (Triple DES cbc mode with
    HMAC/sha1)
       5 root/apdevl3.example.com at EXAMPLE.COM (ArcFour with HMAC/md5)
       5 root/apdevl3.example.com at EXAMPLE.COM (DES cbc mode with CRC-32)

Thanks a lot for any advice. Yours,

    -mi