2

I have several RHEL6 systems with the same configuration. I have had CIFS mounts working for years. However in the past month, it has stopped working on one of my systems and I cannot seem to figure out why.

(See configuration below)

I have a valid host principal in my keytab. When I attempt to mount a CIFS mount (/net/programs), I am getting the following error:

mount error(126): Required key not available
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

The error seems to relate to cifs.upcall and when comparing the debug log, I notice the following difference in the log:

krb5_get_init_creds_keytab: -1765328203
handle_krb5_mech: getting service ticket for server0.domain0.local
cifs_krb5_get_req: unable to resolve (null) to ccache
handle_krb5_mech: failed to obtain service ticket (-1765328245)

The error (-1765328203) seems to map to KRB5_KT_NOTFOUND "Key table entry not found".

However the permissions on krb5.keytab look correct and match my other systems.klist -k displays the correct keys (matching my other systems) and kinit -k is successful.

Another strange behavior. As a temporary workaround, I can mount the share using NTLMSSPI and my username but the mount is only visible in my session. If I login with a new session, the mount doesn't appear. I don't even see it in /proc/mounts even though it does in the original session.

My systems are all on Kernel version 2.6.32-696-23.1 and have Samba version 3.6.23-46.

Configuration:

SMB.CONF:
[global]
   workgroup = DOMAIN0
   password server = server0.DOMAIN0.LOCAL
   realm = DOMAIN0.LOCAL
   security = ads
   idmap config * : backend
   idmap config * : range = 300000-399999
   idmap config DOMAIN0:backend = rid
   idmap config DOMAIN0:range = 100000-199999
   idmap config DOMAIN0:base_rid = 0
   template shell = /bin/bash
   winbind enum users = no
   winbind enum groups = no
   winbind separator = +
   winbind use default domain = yes
   winbind offline logon = false
   kerberos method = secrets and keytab
   client signing = mandatory
   server signing = mandatory


NSSWITCH.CONF:
passwd:     files winbind
shadow:     files winbind
group:      files winbind
hosts:      files dns

SYSTEM-AUTH:
auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_winbind.so use_first_pass
auth        [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900
auth        required      pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_winbind.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 minlen=14 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 difok=4 remember=24 maxrepeat=3
password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok
password    sufficient    pam_winbind.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     required      pam_lastlog.so showfailed
session     optional      pam_oddjob_mkhomedir.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

REQUEST-KEY.CONF
#OP     TYPE    DESCRIPTION     CALLOUT INFO    PROGRAM ARG1 ARG2 ARG3 ...
#====== ======= =============== =============== ===============================
create  user    debug:*         negate          /bin/keyctl negate %k 30 %S
create  user    debug:loop:*    *               |/bin/cat
create  user    debug:*         *               /usr/share/keyutils/request-key-debug.sh %k %d %c %S
negate  *       *               *               /bin/keyctl negate %k 30 %S
create  cifs.spnego  *          *               /usr/sbin/cifs.upcall %k
create  cifs.idmap      *       *               /usr/sbin/cifs.idmap %k
create  dns_resolver  *         *               /usr/sbin/cifs.upcall %k

KRB5.CONF
[libdefaults]
 default_realm = DOMAIN0.LOCAL
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 DOMAIN0.LOCAL = {
  kdc = server0.DOMAIN0.LOCAL
 }



FSTAB:
//server0.domain0.local/Programs       /net/programs   cifs    noauto,sec=krb5i,multiuser,cifsacl 0 0

RC.LOCAL
/sbin/ntpdate -u server0
/usr/bin/kinit -k
/bin/mount /net/programs

NTP.CONF
server server0.domain0.local iburst
  • Any progress on that? We have the same problem (except the client being ArchLinux), and struggle to get it up and running again. – PVitt Sep 11 '18 at 8:36
  • Yes but not helpful. It just suddenly started working again with no change in settings. – eng3 Sep 11 '18 at 12:39
  • Turns out that our problem was solved by adding vers=2.0 mount option. Due to some reason, this needs to be specified now. – PVitt Sep 12 '18 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.