1

I'm using Debian Buster where I have Kerberos, LDAP and SSSD working. I was mounting my home directory on the client using NFS however I realized it was insecure. So I implemented Kerberos mounting.

However when trying to login through lightdm on boot it goes black and boots me back to the lightdm login screen with no error. I found this in /var/log/syslog:

Error reading existing Xauthority: Failed to open file “/home/ben/.Xauthority”: Permission denied
Error writing X authority: Failed to open X authority /home/ben/.Xauthority: Permission denied

I logged in as root from tty1 then did su ben, ran kinit and it seems I can't read/write to any file in my home directory that is owned by me - only ones with read set on other.

Here is my /etc/exports from my server:

/home/ 192.168.16.0/24(rw,sec=krb5p,sync,fsid=0,crossmnt,no_subtree_check)

Here is my /etc/fstab:

192.168.16.20:/home /home nfs defaults,exec 0 0

Client's keytab file as requested:

host/client@DOMAIN
host/client@DOMAIN
nfs/client@DOMAIN
nfs/client@DOMAIN

NFS principals in Kadmin on server:

nfs/server@DOMAIN
nfs/client@DOMAIN

I've been debugging this for sometime and I'm really struggling to get anywhere. The mount looks like it's mounted correctly. My user has a Kerberos ticket. The permissions look perfect and I can read/write with the same user just fine on the server.

Please let me know if you need any more information to help fix this issue.

Update I found this in the auth log of the server when I try to login on the client.

NEEDED_PREAUTH: ben@DOMAIN for krbtgt/DOMAIN@DOMAIN, Additional pre-authentication required
ISSUE: authtime 1622558991, etypes {rep=18 tkt=18 ses=18}, ben@DOMAIN for krbtgt/DOMAIN@DOMAIN

However I don't know why as I'm running NTP on the server and have ntpdate on the client pointing to the server. Also if I run watch -n 1 date -R on the client and server, place the terminal windows side by side they show the exact same time. This error also appears when authenticating with kinit so I'm not sure if it's related to the issue.

1
  • Not sure about the PAM's aspect but can we take a look at purely the Kerberos part here. What does your Kerberos Keytab look like? Can you do a klist -k <keytab> and make sure your TGT is valid? Does the KDC in your environment have a NFS Service Principal Name for the Server in question. Can you obtain a Service Ticket for the NFS Server with a kvno "service principal"
    – Sam0161
    May 21, 2021 at 15:23

1 Answer 1

2

So I never found an error pointing me in the right direction. However I suspected id mapping was at fault due my user showing uid 1000 and the uid on the home directory showing 1000 too. After messing with config files and rebooting the server and client several times I solved the issue.

The Solution
Add the following lines to /etc/idmapd.conf on the server in the [General] section:

Domain = domain
Local-Realms = DOMAIN

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .