5

I have NFS&Kerberos configured as described here: How do I configure a Kerberos NFS server on Red Hat Enterprise Linux 7

All diagnostics operations come fine, but when I try to mount my shares on the client side, I am getting following message:

mount.nfs4: access denied by server while mounting kdc.example.com:/var/backup

Both server&client's IPs are in both /etc/hosts (server & client machines), in a first place after the IP. My configuration is:

/etc/krb5.conf

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 EXAMPLE.COM = {
  kdc = kdc.example.com
  admin_server = kdc.example.com
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM

/etc/exports:

/var/backup client.example.com(rw,sync,no_wdelay,nohide,no_subtree_check,no_root_squash,sec=krb5)
/mnt/storage client.example.com(rw,sync,no_wdelay,nohide,no_subtree_check,no_root_squash,sec=krb5)

/var/kerberos/krb5kdc:

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 EXAMPLE.COM = {
    kdc_ports = 88
    admin_keytab = /etc/kadm5.keytab
    database_name = /var/kerberos/krb5kdc/principal
    acl_file = /var/kerberos/krb5kdc/kadm5.acl
    key_stash_file = /var/kerberos/krb5kdc/stash
    max_life = 10h 0m 0s
    max_renewable_life = 7d 0h 0m 0s
    master_key_type = des3-hmac-sha1
    supported_enctypes = arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3
    default_principal_flags = +preauth
}

krb5kdc & kadmin services are up and running on the server.

/etc/fstab on client:

#NFS area
kdc.example.com:/var/backup                              /mnt/backup                   nfs4     rsize=65536,wsize=65536,nolock,hard,sec=krb5
kdc.example.com:/mnt/storage                             /mnt/storage                  nfs4     rsize=65536,wsize=65536,nolock,hard,sec=krb5

When I do:

mount -vv -t nfs4 -o sec=krb5 kdc.example.com:/var/backup backup

I am getting message:

mount.nfs4: timeout set for Mon May 22 23:32:59 2017
mount.nfs4: trying text-based options 'sec=krb5,addr=95.85.33.75,clientaddr=192.168.0.2'
mount.nfs4: mount(2): Permission denied
mount.nfs4: access denied by server while mounting kdc.example.com:/var/backup

First remark - why clientaddr is 192.168.0.2 but not client.example.com which is set in the both /etc/hosts? Anyways, the same message appears when I add clientaddr=client.example.com into the -o option of mount.

Second message is in the /var/log/krb5kdc.log of server:

CLIENT_NOT_FOUND: NOUSER@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Client not found in Kerberos database

klist -k on server:

Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 host/kdc.example.com@EXAMPLE.COM
   3 host/kdc.example.com@EXAMPLE.COM
   3 host/kdc.example.com@EXAMPLE.COM
   3 nfs/kdc.example.com@EXAMPLE.COM
   3 nfs/kdc.example.com@EXAMPLE.COM
   3 nfs/kdc.example.com@EXAMPLE.COM

klist -k on client:

Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 host/client.example.com@EXAMPLE.COM
   2 host/client.example.com@EXAMPLE.COM
   2 host/client.example.com@EXAMPLE.COM
   2 nfs/client.example.com@EXAMPLE.COM
   2 nfs/client.example.com@EXAMPLE.COM
   2 nfs/client.example.com@EXAMPLE.COM

kadmin -p root/admin:

kadmin:  listprincs
K/M@EXAMPLE.COM
edrive@EXAMPLE.COM
host/client.example.com@EXAMPLE.COM
host/kdc.example.com@EXAMPLE.COM
kadmin/admin@EXAMPLE.COM
kadmin/changepw@EXAMPLE.COM
kadmin/example.com@EXAMPLE.COM
krbtgt/EXAMPLE.COM@EXAMPLE.COM
nfs/client.example.com@EXAMPLE.COM
nfs/kdc.example.com@EXAMPLE.COM
root/admin@EXAMPLE.COM

So, what the issue is? Why I cannot mount my NFS share?

1

I got the same issue. According to this smal tutorial https://www.certdepot.net/rhel7-use-kerberos-control-access-nfs-network-shares/ you should enable nfs-secure-server service in server side and nfs-secure service in client side. This should solve the problem.

0

I know it is somewhat old, but if you're still looking for this, I've faced similar problem and got a solution myself, you can get this at my answer to my problem "Fedora 26 NFS + Kerberos “Preauthentication failed” (mount lead to no permission)", I'm pretty sure RHEL can follow those settings

0

I ran into the same issue yesterday and this seems to occur because of missing principals on the KDC and rpc-gssd.service being stopped on the client.

On the KDC server, a tail -f /var/log/krb5kdc.log should be launched and missing principals if any should appear in the log when attempts of mounting the NFS share is being made from the client.

[vagrant@desktop1 ~]$ sudo mount -o sec=krb5 server1:/knfs /knfs -v
mount.nfs: timeout set for Sun Feb 24 09:44:35 2019
mount.nfs: trying text-based options 'sec=krb5,vers=4.1,addr=192.168.121.163,clientaddr=192.168.121.26'
mount.nfs: mount(2): Permission denied
mount.nfs: trying text-based options 'sec=krb5,vers=4.0,addr=192.168.121.163,clientaddr=192.168.121.26'
mount.nfs: mount(2): Permission denied
mount.nfs: trying text-based options 'sec=krb5,addr=192.168.121.163'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: portmap query failed: RPC: Remote system error - No route to host
^C
[vagrant@desktop1 ~]$ 

In the log output the missing principal has been identified:

[vagrant@server1 ~]$ sudo tail -f /var/log/krb5kdc.log 
Feb 24 09:42:35 server1 krb5kdc[2870](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 192.168.121.26: LOOKING_UP_SERVER: authtime 0,  nfs/desktop1.example.com@EXAMPLE.COM for nfs/kerberos.example.com@EXAMPLE.COM, Server not found in Kerberos database
Feb 24 09:42:35 server1 krb5kdc[2870](info): TGS_REQ (4 etypes {18 17 16 23}) 192.168.121.26: LOOKING_UP_SERVER: authtime 0,  nfs/desktop1.example.com@EXAMPLE.COM for nfs/kerberos.example.com@EXAMPLE.COM, Server not found in Kerberos database
Feb 24 09:42:35 server1 krb5kdc[2870](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 192.168.121.26: LOOKING_UP_SERVER: authtime 0,  nfs/desktop1.example.com@EXAMPLE.COM for nfs/kerberos.example.com@EXAMPLE.COM, Server not found in Kerberos database
Feb 24 09:42:35 server1 krb5kdc[2870](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 192.168.121.26: LOOKING_UP_SERVER: authtime 0,  nfs/desktop1.example.com@EXAMPLE.COM for nfs/kerberos.example.com@EXAMPLE.COM, Server not found in Kerberos database

The missing principal needs to be added on the KDC and the client's key should be exported to the client {/etc/krb5.keytab}.

sudo kadmin.local -q "ktadd nfs/kerberos.example.com"
sudo kadmin.local -q "ktadd -k /tmp/krb5.keytab nfs/desktop1.example.com"

The keytab on the client side :

[vagrant@desktop1 ~]$ sudo klist -ek
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 nfs/desktop1.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96) 
   3 nfs/desktop1.example.com@EXAMPLE.COM (aes128-cts-hmac-sha1-96) 
   3 nfs/desktop1.example.com@EXAMPLE.COM (des3-cbc-sha1) 
   3 nfs/desktop1.example.com@EXAMPLE.COM (arcfour-hmac) 
   3 nfs/desktop1.example.com@EXAMPLE.COM (camellia256-cts-cmac) 
   3 nfs/desktop1.example.com@EXAMPLE.COM (camellia128-cts-cmac) 
   3 nfs/desktop1.example.com@EXAMPLE.COM (des-hmac-sha1) 
   3 nfs/desktop1.example.com@EXAMPLE.COM (des-cbc-md5) 
[vagrant@desktop1 ~]$ 

The permission denied should no longer be present but another warning should appear for wrong arguments.

[vagrant@desktop1 ~]$ sudo mount -o sec=krb5 server1:/knfs /knfs -v
mount.nfs: timeout set for Sun Feb 24 09:07:32 2019
mount.nfs: trying text-based options 'sec=krb5,vers=4.1,addr=192.168.121.54,clientaddr=192.168.121.195'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,vers=4.0,addr=192.168.121.54,clientaddr=192.168.121.195'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,addr=192.168.121.54'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: portmap query failed: RPC: Remote system error - No route to host
mount.nfs: trying text-based options 'sec=krb5,vers=4.0,addr=192.168.121.54,clientaddr=192.168.121.195'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,addr=192.168.121.54'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: portmap query failed: RPC: Remote system error - No route to host
mount.nfs: trying text-based options 'sec=krb5,vers=4.0,addr=192.168.121.54,clientaddr=192.168.121.195'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,addr=192.168.121.54'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: portmap query failed: RPC: Remote system error - No route to host
^C
[vagrant@desktop1 ~]$ 

After starting the service rpc-gssd.service, the error disappears and the NFS share was mounted correctly:

[vagrant@desktop1 ~]$ sudo systemctl start rpc-gssd.service 
[vagrant@desktop1 ~]$ sudo mount -o sec=krb5 server1:/knfs /knfs -v mount.nfs: 
timeout set for Sun Feb 24 09:07:47 2019 mount.nfs: trying text-based options 'sec=krb5,vers=4.1,addr=192.168.121.54,clientaddr=192.168.121.195' 
[vagrant@desktop1 ~]$

Tickets were as follows:

[vagrant@desktop1 ~]$ sudo klist -e
Ticket cache: KEYRING:persistent:0:krb_ccache_kfAgj83
Default principal: nfs/desktop1.example.com@EXAMPLE.COM

Valid starting     Expires            Service principal
01/01/70 00:00:00  01/01/70 00:00:00  Encrypted/Credentials/v1@X-GSSPROXY:
[vagrant@desktop1 ~]$ 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.