Cannot mount nfsv4 krb5.

Patrik Martinsson Patrik.Martinsson at smhi.se
Wed Aug 4 11:41:44 EDT 2010


Hello everyone,

I'm not sure this is a bug or whats going on, however i can't get it to 
work.
I posted a bug at redhat's bugzilla buts since its not a blocker issue i 
dont know how much they are looking into my issues, figured i maybe get 
a quicker answer here.

I'm on RHEL 6 Beta 2, Refresh.

Here's what i wrote in my bugreport, maybe someone have had a similar 
issue ?

Description of problem:
Not really sure this is a bug of krb5, but i suspect so. I cant mount nfsv4
with krb5, without the sec=krb5 option it works like a charm.

Version-Release number of selected component (if applicable):

krb5-libs-1.8.2-2.el6.x86_64
krb5-workstation-1.8.2-2.el6.x86_64
gssdp-0.7.1-1.el6.x86_64

How reproducible:
Always.

Steps to Reproduce:

# /etc/krb5.conf
[libdefaults]
   default_realm = XX.XXXX.XX
   clockskew = 300
   dns_lookup_realm = true
   dns_lookup_kdc = true
   default_tkt_enctypes =  des-cbc-md5
   default_tgs_enctypes =  des-cbc-md5
   forwardable = true
   allow_weak_crypto = true

[realms]
   XX.XXXX.XX = {
     default_domain = XX.XXXX.XX
   }

[logging]
   kdc = FILE:/var/log/krb5/krb5kdc.log
   admin_server = FILE:/var/log/krb5/kadmind.log
   default = SYSLOG:NOTICE:DAEMON

[domain_realm]
   .XX.XXXX.XX = XX.XXXX.XX
   .xxxx.xx = XX.XXXX.XX

  # /etc/idmapd.conf
  Domain = xxxx.xx

  # /etc/sysconfig/nfs
  RPCIDMAPDARGS="-vvvv"
  SECURE_NFS="yes"
  RPCGSSDARGS="-vvvv"
  RPCSVCGSSDARGS="-vvvv"

  # Stop all relevant services
  /etc/init.d/rpcbind stop; /etc/init.d/rpcgssd stop; /etc/init.d/rpcidmapd
stop; /etc/init.d/nfs stop

  # Make sure we are not in domain, leave and flush keytab.
  net ads leave -U xx%xx
  net ads keytab flush -U xx%xx

  # Make sure we have no tickets/keytabs or whatsoever.
  kdestroy
  rm -rf /etc/krb5.keytab
  rm -rf /tmp/kr*

  # Join machine to AD and create computer account with both service principle
and user principle.
  net ads join createupn="nfs/$HOSTNAME at XX.XXXX.XX" createcomputer="/FOO/BAR"
osName="Linux Red Hat Workstation" osVer="6" -U xx%xx

  # Add nfs principle to keytab, there is already one entry (with diff
encryptions) so i'm not totally sure if this is needed.
  net ads keytab add nfs -U xx%xx
  This is nfs section before i issue the following command,
  2 08/04/10 16:32:03 nfs/client.xxxx.xx at XX.XXXX.XX (DES cbc mode with CRC-32)
  2 08/04/10 16:32:03 nfs/client.xxxx.xx at XX.XXXX.XX (DES cbc mode with RSA-MD5)
  2 08/04/10 16:32:03 nfs/client.xxxx.xx at XX.XXXX.XX (ArcFour with HMAC/md5)
  -- After --
  2 08/04/10 16:33:18 nfs/client.xxxx.xx at XX.XXXX.XX (DES cbc mode with CRC-32)
  2 08/04/10 16:33:18 nfs/client.xxxx.xx at XX.XXXX.XX (DES cbc mode with RSA-MD5)
  2 08/04/10 16:33:18 nfs/client.xxxx.xx at XX.XXXX.XX (ArcFour with HMAC/md5)
  2 08/04/10 16:33:19 nfs/CLIENT at XX.XXXX.XX (DES cbc mode with CRC-32)
  2 08/04/10 16:33:19 nfs/CLIENT at XX.XXXX.XX (DES cbc mode with RSA-MD5)
  2 08/04/10 16:33:19 nfs/CLIENT at XX.XXXX.XX (ArcFour with HMAC/md5)

  # Now we have joined the machine (created a machineaccount), we got a keytab
that looks ok. Start the relevant services.
  /etc/init.d/rpcbind start; /etc/init.d/rpcgssd start; /etc/init.d/rpcidmapd
start; /etc/init.d/nfs start

  # Issue mount command,
  mount -t nfs4 -o sec=krb5 xx:/xx/xx/xx/ /nfstest/ -vvvvv

  # Output,
  -- mount --
  mount: fstab path: "/etc/fstab"
  mount: mtab path:  "/etc/mtab"
  mount: lock path:  "/etc/mtab~"
  mount: temp path:  "/etc/mtab.tmp"
  mount: spec:  "xx:/xx/xx/xx/"
  mount: node:  "/nfstest/"
  mount: types: "nfs4"
  mount: opts:  "sec=krb5"
  mount: external mount: argv[0] = "/sbin/mount.nfs4"
  mount: external mount: argv[1] = "xx:/xx/xx/xx/"
  mount: external mount: argv[2] = "/nfstest/"
  mount: external mount: argv[3] = "-v"
  mount: external mount: argv[4] = "-o"
  mount: external mount: argv[5] = "rw,sec=krb5"
  mount.nfs4: timeout set for Wed Aug  4 16:24:41 2010
  mount.nfs4: text-based options:
'sec=krb5,clientaddr=xx.xx.x.xx,addr=xxx.xx.xx.xx'
  mount.nfs4: mount(2): Permission denied
  mount.nfs4: access denied by server while mounting xx:/xx/xx/xx/

  -- /var/log/messages --
  Aug  4 14:45:09 client rpc.idmapd[4656]: New client: 13
  Aug  4 14:45:09 client rpc.idmapd[4656]: Opened
/var/lib/nfs/rpc_pipefs//nfs/clnt13/idmap
  Aug  4 14:45:09 client rpc.idmapd[4656]: New client: 14
  Aug  4 14:45:09 client rpc.gssd[4635]: handling gssd upcall
(/var/lib/nfs/rpc_pipefs/nfs/clnt13)
  Aug  4 14:45:09 client rpc.gssd[4635]: handle_gssd_upcall: 'mech=krb5 uid=0
enctypes=18,17,16,23,3,1,2 '
  Aug  4 14:45:09 client rpc.gssd[4635]: handling krb5 upcall
(/var/lib/nfs/rpc_pipefs/nfs/clnt13)
  Aug  4 14:45:09 client rpc.gssd[4635]: process_krb5_upcall: service is
'<null>'
  Aug  4 14:45:09 client rpc.gssd[4635]: Full hostname for 'xx.xxxx.xx' is
'xx.xx.xx'
  Aug  4 14:45:09 client rpc.gssd[4635]: Full hostname for 'client.xxxx.xx' is
'client.xxxx.xx'
  Aug  4 14:45:09 client rpc.gssd[4635]: Key table entry not found while getting
keytab entry for ' root/client.xxxx.xx at XX.XXXX.XX'
  Aug  4 14:45:09 client rpc.gssd[4635]: Success getting keytab entry for
'nfs/client.xxxx.xx at XX.XXXX.XX'
  Aug  4 14:45:09 client rpc.gssd[4635]: Successfully obtained machine
credentials for principal ' nfs/client.xxxx.xx at XX.XXXX.XX' stored in ccache
'FILE:/tmp/krb5cc_machine_XX.XXXX.XX'
  Aug  4 14:45:09 client rpc.gssd[4635]: INFO: Credentials in CC
'FILE:/tmp/krb5cc_machine_XX.XXXX.XX' are good until 1280961909
  Aug  4 14:45:09 client rpc.gssd[4635]: using
FILE:/tmp/krb5cc_machine_XX.XXXX.XX as credentials cache for machine creds
  Aug  4 14:45:09 client rpc.gssd[4635]: using environment variable to select
krb5 ccache FILE:/tmp/krb5cc_machine_XX.XXXX.XX
  Aug  4 14:45:09 client rpc.gssd[4635]: creating context using fsuid 0
(save_uid 0)
  Aug  4 14:45:09 client rpc.gssd[4635]: creating tcp client for server
xx.xxxx.xx
  Aug  4 14:45:09 client rpc.gssd[4635]: DEBUG: port already set to 2049
  Aug  4 14:45:09 client rpc.gssd[4635]: creating context with server
nfs at xx.xxxx.xx
  Aug  4 14:45:09 client rpc.gssd[4635]: WARNING: Failed to create krb5 context
for user with uid 0 for server xx.xxxx.xx
  Aug  4 14:45:09 client rpc.gssd[4635]: WARNING: Failed to create machine krb5
context with credentials cache FILE:/tmp/krb5cc_machine_XX.XXXX.XX for server
xx.xxxx.xx
  Aug  4 14:45:09 client rpc.gssd[4635]: WARNING: Machine cache is prematurely
expired or corrupted trying to recreate cache for server xx.xxxx.xx
  Aug  4 14:45:09 client rpc.gssd[4635]: Full hostname for 'xx.xxxx.xx' is
'xx.xxxx.xx'
  Aug  4 14:45:09 client rpc.gssd[4635]: Full hostname for 'client.xx.xxxx.xx'
is 'client.xx.xxxx.xx'
  Aug  4 14:45:09 client rpc.gssd[4635]: Key table entry not found while getting
keytab entry for 'root/client.xxxx.xx at XX.XXXX.XX'
  Aug  4 14:45:09 client rpc.gssd[4635]: Success getting keytab entry for
'nfs/client.xxxx.xx at XX.XXXX.XX'
  Aug  4 14:45:09 client rpc.gssd[4635]: INFO: Credentials in CC
'FILE:/tmp/krb5cc_machine_XX.XXXX.XX' are good until 1280961909
  Aug  4 14:45:09 client rpc.gssd[4635]: INFO: Credentials in CC
'FILE:/tmp/krb5cc_machine_XX.XXXX.XX' are good until 1280961909
  Aug  4 14:45:09 client rpc.gssd[4635]: using
FILE:/tmp/krb5cc_machine_XX.XXXX.XX as credentials cache for machine creds
  Aug  4 14:45:09 client rpc.gssd[4635]: using environment variable to select
krb5 ccache FILE:/tmp/krb5cc_machine_XX.XXXX.XX
  Aug  4 14:45:09 client rpc.gssd[4635]: creating context using fsuid 0
(save_uid 0)
  Aug  4 14:45:09 client rpc.gssd[4635]: creating tcp client for server
xx.xxxx.xx
  Aug  4 14:45:09 client rpc.gssd[4635]: DEBUG: port already set to 2049
  Aug  4 14:45:09 client rpc.gssd[4635]: creating context with server
nfs at xx.xxxx.xx
  Aug  4 14:45:09 client rpc.gssd[4635]: WARNING: Failed to create krb5 context
for user with uid 0 for server xx.xxxx.xx
  Aug  4 14:45:09 client rpc.gssd[4635]: WARNING: Failed to create machine krb5
context with credentials cache FILE:/tmp/krb5cc_machine_XX.XXXX.XX for server
xx.xxxx.xx
  Aug  4 14:45:09 client rpc.gssd[4635]: WARNING: Failed to create machine krb5
context with any credentials cache for server xx.xxxx.xx
  Aug  4 14:45:09 client rpc.gssd[4635]: doing error downcall
  Aug  4 14:45:09 client rpc.idmapd[4656]: Stale client: 13
  Aug  4 14:45:09 client rpc.idmapd[4656]: #011->  closed
/var/lib/nfs/rpc_pipefs//nfs/clnt13/idmap
  Aug  4 14:45:09 client rpc.idmapd[4656]: Stale client: 14
  Aug  4 14:45:09 client rpc.idmapd[4656]: #011->  closed
/var/lib/nfs/rpc_pipefs//nfs/clnt14/idmap
  Aug  4 14:45:09 client rpc.gssd[4635]: destroying client
/var/lib/nfs/rpc_pipefs/nfs/clnt14
  Aug  4 14:45:09 client rpc.gssd[4635]: destroying client
/var/lib/nfs/rpc_pipefs/nfs/clnt13

Actual results:
mount.nfs4: access denied by server while mounting xx:/xx/xx/xx/

Expected results:
A successful mount.

Additional info:
If i do the exact same steps on a Fedora 10 client this method works.
Is there something im missing ?

Btw.
This thread has kinda the same issue, it seems to work if he downgrades his krb.
I tried that though, but without luck.
I downgraded my krb-libs/krb5-workstation and gssdbp, but without success, but maybe there is some more packages involved..?


My bugreport is at, https://bugzilla.redhat.com/show_bug.cgi?id=621238

Best Regards,
Patrik Martinsson, Sweden.





More information about the Kerberos mailing list