2

I'm trying to set up a kerberized NFS share from an HA cluster. I've successfully set up a krb-aware NFS share from a single server, I'm using a mostly identical configuration on the cluster.

Exports file from working single server:

/nfs    *(rw,sec=krb5:krb5i:krb5p)

Cluster resource configuration:

# pcs resource show nfs-export1
 Resource: nfs-export1 (class=ocf provider=heartbeat type=exportfs)
  Attributes: clientspec=10.1.0.0/255.255.255.0 directory=/nfsshare/exports/export1 fsid=1 options=rw,sec=krb5:krb5i:krb5p,sync,no_root_squash
  Operations: monitor interval=10 timeout=20 (nfs-export1-monitor-interval-10)
              start interval=0s timeout=40 (nfs-export1-start-interval-0s)
              stop interval=0s timeout=120 (nfs-export1-stop-interval-0s)

Client showmount to working single server:

# showmount -e ceserv
Export list for ceserv:
/nfs *

Client showmount to floating cluster name:

# showmount -e hafloat
Export list for hafloat:
/nfsshare/exports/export1 10.1.0.0/255.255.255.0
/nfsshare/exports         10.1.0.0/255.255.255.0

Contents of client /etc/fstab:

ceserv:/nfs /mnt/nfs nfs4 sec=krb5i,rw,proto=tcp,port=2049
hafloat.ncphotography.lan:export1 /nfsmount nfs4 sec=krb5i,rw,proto=tcp,port=2049

Results of mount -av command:

# mount -av
mount.nfs4: timeout set for Mon Dec  4 20:57:14 2017
mount.nfs4: trying text-based options 'sec=krb5i,proto=tcp,port=2049,vers=4.1,addr=10.1.0.24,clientaddr=10.1.0.23'
/mnt/nfs                 : successfully mounted
mount.nfs4: timeout set for Mon Dec  4 20:57:14 2017
mount.nfs4: trying text-based options 'sec=krb5i,proto=tcp,port=2049,vers=4.1,addr=10.1.0.29,clientaddr=10.1.0.23'
mount.nfs4: mount(2): Operation not permitted
mount.nfs4: Operation not permitted

All firewalls have been disabled. All names resolve correctly to IP addresses within the 10.1.0.0/24 network, and all IP addresses reverse-resolve to the correct hostname.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.