Newbie nfsv4 debian, netapp

Fri Oct 25 09:04:00 EDT 2013

That's the trail I'm following but with no clear result :

After the mount I have the following 

25/10/2013 14:07:45  26/10/2013 14:07:44  krbtgt/DO.M at DO.M
	Etype (skey, tkt): des-cbc-crc, aes256-cts-hmac-sha1-96 
25/10/2013 14:07:45  26/10/2013 14:07:44  nfs/server at DO.M
	Etype (skey, tkt): des-cbc-crc, aes256-cts-hmac-sha1-96 

So it seems that the des-cbc-crc is on each.

I have activated a lot of log and what I see in the end : 

Success getting keytab entry for 'nfs/client at DO.M'
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_DO.M' are good until 1382789264
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_DO.M' are good until 1382789264
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: using FILE:/tmp/krb5cc_machine_DO.M as credentials cache for machine creds
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: using environment variable to select krb5 ccache FILE:/tmp/krb5cc_machine_DO.M
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: creating context using fsuid 0 (save_uid 0)
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: creating tcp client for server serveur
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: DEBUG: port already set to 2049
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: creating context with server nfs at serveur
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: WARNING: Failed to create krb5 context for user with uid 0 for serveur
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: WARNING: Failed to create machine krb5 context with credentials cache FILE:/tmp/krb5cc_machine_DO.M for server serveur
Oct 25 14:20:55 wheezy32 rpc.gssd[1862]: WARNING: Failed to create machine krb5 context with any credentials cache for server serveur

>From what I saw it could be a srvgssd problem, but on the netapp side...

Btw when you write KDB is it KDC or keytab of the netapp filer ?

Thanks 

f.g.

Le 25 oct. 2013 à 14:29, Thomas Krauss - ITServ GmbH <thomas.krauss at itserv.de> a écrit :

> Two possible solutions:
> a.) Delete all but DES keys from Netapps nfs principal in KDB.
> b.) configure default_tgs_enctypes to only use DES
> 
> In fact it works with arcfour as well but Netapp does not support it officially.
> 
> 
>  
>  
> -----Ursprüngliche Nachricht-----
> > Von:Frédéric Goudal <frederic.goudal at ipb.fr>
> > Gesendet: Fre 25 Oktober 2013 09:17
> > An: Thomas Krauss - ITServ GmbH <thomas.krauss at itserv.de>
> > CC: Frédéric Goudal <frederic.goudal at ipb.fr>; kerberos at mit.edu
> > Betreff: Re: Newbie nfsv4 debian, netapp
> > 
> > Ok, you are right.
> > 
> > What I did was mount.nfs4 -o sec=krb5 
> > But the correct command is 
> > mount -t nfs -o "vers=4,sec=krb5"
> > 
> > THe result is : 
> > 
> > Oct 25 08:47:02 kerberos krb5kdc[2631](info): AS_REQ (2 etypes {16 17}) 147.210.18.37: NEEDED_PREAUTH: nfs/client.fqdnr at IPB.FR for krbtgt/DO.M at DO.M, Additional pre-authentication required
> > Oct 25 08:47:02 kerberos krb5kdc[2631](info): AS_REQ (2 etypes {16 17}) 147.210.18.37: ISSUE: authtime 1382683622, etypes {rep=16 tkt=18 ses=16}, nfs/client.fqdnr at DO.M for krbtgt/DO.M at DO.M
> > Oct 25 08:47:03 kerberos krb5kdc[2631](info): TGS_REQ (2 etypes {16 17}) 147.210.18.37: ISSUE: authtime 1382683622, etypes {rep=16 tkt=18 ses=16}, nfs/client.fqdnr at DO.M for nfs/serv.fqdn at DO.M
> > 
> > So as far as I understand it seemst that the service ticket to access the nfs server is delivered.
> > 
> > But on the netapp filer I have 
> > Kerberos: encryption type 18 not supported
> > 
> > From what I read in the netapp doc it seems that the netapp does only support des + crc encryption
> > 
> > I tried to remove all but (des-cbc-crc) encryption in the /etc/krb5.keytab on the client for the nfs/client principal
> > but the kerberos server does not go further thant needed_preauth...
> > 
> > I guess I have something to do in the configuration so that dec encryption can be used ?
> > 
> > f.g.
> > 
> > 
> > Le 25 oct. 2013 à 08:14, Tom_Krauss <thomas.krauss at itserv.de> a écrit :
> > 
> > > You probably do not mount kerberized at all.
> > > Use "mount -o sec=krb5 ..." or change the clients defaults.
> > > 
> > > Hth
> > > 
> > > 
> > > 
> > > --
> > > View this message in context: http://kerberos.996246.n3.nabble.com/Newbie-nfsv4-debian-netapp-tp38752p38761.html
> > > Sent from the Kerberos - General mailing list archive at Nabble.com.
> > > ________________________________________________
> > > Kerberos mailing list           Kerberos at mit.edu
> > > https://mailman.mit.edu/mailman/listinfo/kerberos
> > 
> > 
> 
> 
> --
> Angaben gemäß �35a GmbH-Gesetz:
> ITServ GmbH
> Sitz der Gesellschaft: 55294 Bodenheim/Rhein
> Eingetragen unter Registernummer HRB 41668 beim Amtsgericht Mainz
> Vertretungsberechtiger Geschäftsführer: Peter Bauer, 55294 Bodenheim
> Umsatzsteuer-ID: DE182270475
> 
> 