0

I'm trying to mount a Windows share on a Linux host (Ubuntu 16.04) using Kerberos / Active Directory authentication. The Linux host has been joined to the AD, and I can access shares on it from the Windows world. Also, I can access my Windows share from Linux via username. What doesn't work however is this:

$ sudo mount -t cifs -o sec=krb5i //mysrv/scratch mount
mount error(524): Unknown error 524
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

$ sudo mount -t cifs -o sec=krb5i,vers=3.0 //mysrv/scratch mount
mount error(128): Key has been revoked
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

kinit works for my user principal

$ kinit first.last@COMPANY-DE.LOCAL
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: first.last@COMPANY-DE.LOCAL

Valid starting       Expires              Service principal
07.02.2019 14:28:51  08.02.2019 00:28:51  krbtgt/COMPANY-DE.LOCAL@COMPANY-DE.LOCAL
        renew until 08.02.2019 14:28:48

I can also do this to get a service principal for my host:

$ kinit -k
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: host/buildserver-01.company-de.local@COMPANY-DE.LOCAL

Valid starting       Expires              Service principal
07.02.2019 14:28:30  08.02.2019 00:28:30  krbtgt/COMPANY-DE.LOCAL@COMPANY-DE.LOCAL
        renew until 08.02.2019 14:28:30

My intention is that I can mount a remote share, and have different unix users access this share by each doing kinit. I think it should work, but is not clear to me what the prerequisites for this are. Any ideas?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.