Kerberized NFS (GSS-API) problem with multiple-IP Address and single hostname

[Frank Cusack]

On 1/11/11 2:51 AM +0000 sandeep patil wrote:
>
> Thanks all for your suggestions.
>
> Warload - well the problem is having one - name.example.com results in
> multiple IP Addresses. As rightly pointed out by frank.
>
>> You did make me think of another solution.  Force the use of TCP.  That
>> won't be 100% reliable (depends on client implementation) but it might
>> be good enough.
>
> Why would forcing it to TCP help ? Any Clue/advice ..
>
>>> The typical way to handle this is with the automounter.  With
>>> automounted NFS filesystems,  you can specify multiple NFS servers per
>>> mount, and the client picks one and sticks with it.
> This may not work as even if we are able to have an NFS client stick to a
> single NFS server, the kerberized part of NFS which inturn calls GSS-API
> internally does a host lookup (almost everytime) and contacts the DNS for
> an IP and ends up with a new IP each time. :-(

Ah, right.  So the TCP idea wouldn't work either.

>>> Or instead of a load balancer it could be a load
>>> balanced DNS server (gives only a single IP address but a different
>>> one per client).
> This could work but will need enhancements at the DNS server side unless
> its inhirently supported by DNS, no clue there . Any input ?

There are several examples of load balanced DNS servers.  You could
write it yourself in Perl/Python without *too much* difficulty.  But
I'd probably opt to go with something like tinydns
(<http://cr.yp.to/djbdns/tinydns-data.html>).  Set your TTLs to 0
and write a monitoring tool around it to take servers that are down
out of the DNS rotation.  Just delegate .nfs.dom.ain to your special
dns server.