5

I'm having a hard time trying to setup nfs + kerberos at Fedora 26.

I've followed this tutorial:

RHEL7: Use Kerberos to control access to NFS network shares | CertDepot

At the moment, pure NFS works fine, kinit alone works fine, but I still get no permission while trying to mount and those errors at /var/log/krb5kdc.log.

krb5kdc[12560](info): AS_REQ (8 etypes {18 17 16 23 25 26 20 19}) 192.168.0.13: NEEDED_PREAUTH: nfs/rbenedettin.local@LOCAL for krbtgt/LOCAL@LOCAL, Additional pre-authentication required                        
krb5kdc[12560](info): preauth (encrypted_timestamp) verify failure: Preauthentication failed                                                                                                                      
krb5kdc[12560](info): AS_REQ (8 etypes {18 17 16 23 25 26 20 19}) 192.168.0.13: PREAUTH_FAILED: nfs/rbenedettin.local@LOCAL for krbtgt/LOCAL@LOCAL, Preauthentication failed

I want to use zero-config, I tried without it (editing /etc/hosts), but the problem persists, some other tutorials, point to authconfig-gui or authconfig-tui but Fedora 26 does not have it anymore. There is near no information on the web about recent Fedora releases and nfs + kerberos so I would really appreciate any light on it.

3

What Appears To Be The Problem

The tutorial completely ignored many needed elements in fact (sssd, pam, etc), probably it is not the point of it as the focus appears to be RHEL exams. I'm still a little lost on all tools involved in this task as I'm not a sysadmin (a lot of question for another moment), but I've managed to get it working. Thanks to freeIPA most.

I will try to put what I did here. I expect it gives some light on how to get a kerberized NFS environment in Fedora 26 and maybe 25 plus. please, anyone that finds any inadequate procedure please, correct it. It only touches a zero-conf without SELinux environment, so anywone that can close the gaps is welcome to correct it.

If You Already Did A Lot Of Mess

If you were brave enough to try a ton of things, even put an OpenLDAP server up without results, remove it all, remove both Kerberos and OpenLDAP, delete configurations files and caches in /etc and /var/lib/, you can maintain your NFS server if you already got it working without Kerberos. If you played with sssd delete /etc/sssd and reinstall the package.


How to get NFS + Kerberos in fedora 26

In a short description you will need to:

  1. Hostname (read observations)
  2. NFS server working.
  3. Install freeIPA
  4. Configure IPA + Kerberos + NFS
  5. Observations

Hostname

Before continuing please read observations at the end of the answer, related with hostname.

As stated, I wanted a zero-conf setup. I named my machines and enabled/unmasked avahi service. If you have a vanilla Fedora installation Avahi should be on.

You can get or change the hostname with hostnamectl.

$ hostnamectl set-hostname "myhostname"

Thanks to avahi, all your local network will be over local domain, you will get your machines addressed like yourhostname.local. We will continue the setup with two machines:

server.local -> the server

client.local -> the client

Kerberos(freeIPA server) could be on a third machine, but for simplicity, both freeIPA and NFS will be served by one machine.

NFS server

  • Server Side

I will take as if you pretend to use NFSv4, so it only need this:

$ dnf install  nfs-utils

$ systemctl enable nfs-server
$ systemctl start nfs-server

$ firewall-cmd --permanent --add-service=nfs
$ firewall-cmd --reload

Edit exports in /etc/exports:

# if using "sec=krb5p" your will need Kerberos, remove it for tests
/path/to/exported/dir client.local(rw,sync,sec=krb5p)

Export the directory:

$ exportfs -avr
$ systemctl restart nfs-server
  • Client Side

Install needed package:

$ dnf install nfs-utils

You can test it with:

$ mount -t nfs server.local:/path/to/exported/dir /path/to/local/dir

Install FreeIPA

  • Server Side

Install freeipa-server and give pointed answers:

$ dnf install freeipa-server
$ ipa-server-install
...
Do you want to configure integrated DNS (BIND)? [no]: **no**
...
Server host name [server.local]: **press enter**    
...
Please confirm the domain name [local]: **press enter**
...
Please provide a realm name [LOCAL]: **press enter**
...
Directory Manager password: *******
Password (confirm): *******
...
IPA admin password: *******
Password (confirm): *******
...
Continue to configure the system with these values? [no]: **yes**

open needed firewall ports:

$ firewall-cmd --add-service={freeipa-ldap,freeipa-ldaps} --permanent 
$ firewall-cmd --reload 
  • Client Side

Install freeipa-client and give pointed answers:

$ dnf install freeipa-client
$ ipa-client-install --server=serve.local --domain LOCAL
... 
Proceed with fixed values and no DNS discovery? [no]: **yes**
...
Continue to configure the system with these values? [no]: **yes**
...
User authorized to enroll computers: **admin**
...
Password for admin@SERVER.LOCAL: ******

Configure IPA + Kerberos + NFS

At this point you will have an operational kerberos server and client, I will pretend that you have only a user named user at server and client.

  • Server Side

We must authenticate as admin principal:

$ kinit admin
Password for admin@SERVER.LOCAL: *****

You can confirm you're authenticated with klist:

$ klist
Ticket cache: KEYRING:persistent:1000:krb_ccache_######       
Default principal: admin@LOCAL                            

Valid starting       Expires              Service principal    
17-10-2017 20:41:20  18-10-2017 20:41:17  krbtgt/LOCAL@LOCAL       

Now we can add user principal, I advise you to use the same name and password of your Unix user:

$ ipa user-add user --email=user@yourmail.com --first=User --last="Foo" --password
password: ******

Add the service principal for NFS:

# --force is needed otherwise will complain about DNS record missing
$ ipa service-add nfs/server.local --force

get host and service keys:

$ ipa-getkeytab -s server.local -p host/server.local -k /etc/krb5.keytab
Keytab successfully retrieved and stored in: /etc/krb5.keytab

$ ipa-getkeytab -s server.local -p nfs/server.local -k /etc/krb5.keytab
Keytab successfully retrieved and stored in: /etc/krb5.keytab
  • Client Side

    As at server side, authenticate as admin and add client host:

    $ kinit admin Password for admin@SERVER.LOCAL: *****

    $ ipa-getkeytab -s server.local -p host/client.local -k /etc/krb5.keytab Keytab successfully retrieved and stored in: /etc/krb5.keytab

Don't forget to add sec=krb5p to /etc/export at the server after configuring freeIPA and all the rest. Restart the server and client or restart NFS and IPA services. At this point, you will be able to mount the remote folder at the client.

$ mount -v -t nfs -o sec=krb5p server.local:/path/to/exported/dir /path/to/local/dir

Observations

Zero-config setup not working well...

unfortunately, FreeIPA appears to be strongly dependent on BIND, a DNS server, a shame as it is too much for home use and can impose performance burden on low-end devices. The simples solution is not using dhcp, setting static IPs on all machines and define aliases in `/etc/hosts´:

x.x.x.x server.local server      
y.y.y.y client.local client 

Why not configure pam so I get Kerberos Authentication at Login?

by what we can see here freeipa, if using sssd don't need authconfig --enablekrb5 --update.

Partition Mounts But While accessing directory get "no permission" and an empty folder

Your user probably need access to its principal key (only root has access to /etc/krb5.keytab), according to krb5.conf man page, sssd default place for users keytab is /var/kerberos/krb5/user/%{UID}/client.keytab where %{UID} is the user id of the user.

$ ipa-getkeytab -s server.local -p user -k /var/kerberos/krb5/user/%{UID}/client.keytab --password
password: ******
Keytab successfully retrieved and stored in: /var/kerberos/krb5/user/%{UID}/client.keytab 

Use the same password of unix user, we could have used -r, but it is nor recommended and actually need extra commands to be possible to retrive the existing keys (from when we have added the user) from server.

Chrony or NTP???

I'm not sure if freeIPA can work well with chrony, newer versions may need --force-ntpd to supplant chrony with NTP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.