0

I have a server, Ubuntu 16.04, exporting an NFS share with Kerberos security. I have a laptop client, Ubuntu 17.10, that connects to the server. The client is configured to mount the share using autofs. I created a keytab on the server and copied it onto the client.

I am able to reach the share. However, it doesn't work immediately on login on the laptop; the directory mounts, but in a strange state where I don't really have permission to use it.

In order to make it work, I have to do EITHER

sudo service rpc-gssd restart

OR

kinit
[type in password when prompted]

After either of those, I am able to browse to the mounted share successfully.

Is this expected behaviour? If not, how can I fix it? If it is normal, is there some way I can automatically run kinit, when the network comes up? It's connecting via wifi, so the network isn't available immediately on boot, only when a user logs in and unlocks the password keyring.

Thank you for any help.

UPDATE

I have discovered that if I boot my laptop while it's physically plugged in to the network, everything works correctly. I think "pam" is the mechanism that makes it all work without having to manually get a ticket, but it looks like pam doesn't work if I have no network connection at the point of logging in.

2

The problem is that, using NetworkManager, there's no network connection at the time of login. NetworkManager has a per-user list of wifi networks, and it doesn't log into a network until after a user logs in.

The solution is to click the "settings" button on the wifi network in Network Settings, and set the network to "available for all users".

Once this is set, the laptop connects to the wifi automatically on boot. Then, when a user logs in, the network is already up and the automatic kerberos ticket magic is able to work.

1

Before you can access to a NFS share kerberized You MUST have a ticket,otherwise there's no security. The solution is to put kinit at login,on your $HOME/.bash_login or $HOME/.bash_profile The kinit of heimdal is very nice because can take pass from STDIN

echo yourpass|kinit
  • Thank you. However, this is a machine where I'm logging into a GUI. The wifi doesn't connect until after I've logged in (using Ubuntu NetworkManager), and I need to make sure kinit runs after the wifi is connected. Is there some usual way to run a script when the network becomes connected? – TenMinJoe Apr 5 '18 at 6:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.