I have NFS&Kerberos configured as described here: How do I configure a Kerberos NFS server on Red Hat Enterprise Linux 7
All diagnostics operations come fine, but when I try to mount my shares on the client side, I am getting following message:
mount.nfs4: access denied by server while mounting kdc.example.com:/var/backup
Both server&client's IPs are in both /etc/hosts (server & client machines), in a first place after the IP. My configuration is:
/etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
EXAMPLE.COM = {
kdc = kdc.example.com
admin_server = kdc.example.com
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
/etc/exports:
/var/backup client.example.com(rw,sync,no_wdelay,nohide,no_subtree_check,no_root_squash,sec=krb5)
/mnt/storage client.example.com(rw,sync,no_wdelay,nohide,no_subtree_check,no_root_squash,sec=krb5)
/var/kerberos/krb5kdc:
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
EXAMPLE.COM = {
kdc_ports = 88
admin_keytab = /etc/kadm5.keytab
database_name = /var/kerberos/krb5kdc/principal
acl_file = /var/kerberos/krb5kdc/kadm5.acl
key_stash_file = /var/kerberos/krb5kdc/stash
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des3-hmac-sha1
supported_enctypes = arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3
default_principal_flags = +preauth
}
krb5kdc & kadmin services are up and running on the server.
/etc/fstab on client:
#NFS area
kdc.example.com:/var/backup /mnt/backup nfs4 rsize=65536,wsize=65536,nolock,hard,sec=krb5
kdc.example.com:/mnt/storage /mnt/storage nfs4 rsize=65536,wsize=65536,nolock,hard,sec=krb5
When I do:
mount -vv -t nfs4 -o sec=krb5 kdc.example.com:/var/backup backup
I am getting message:
mount.nfs4: timeout set for Mon May 22 23:32:59 2017
mount.nfs4: trying text-based options 'sec=krb5,addr=95.85.33.75,clientaddr=192.168.0.2'
mount.nfs4: mount(2): Permission denied
mount.nfs4: access denied by server while mounting kdc.example.com:/var/backup
First remark – why clientaddr is 192.168.0.2 but not client.example.com which is set in the both /etc/hosts? Anyways, the same message appears when I add clientaddr=client.example.com into the -o option of mount.
Second message is in the /var/log/krb5kdc.log of server:
CLIENT_NOT_FOUND: NOUSER@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Client not found in Kerberos database
klist -k on server:
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
3 host/kdc.example.com@EXAMPLE.COM
3 host/kdc.example.com@EXAMPLE.COM
3 host/kdc.example.com@EXAMPLE.COM
3 nfs/kdc.example.com@EXAMPLE.COM
3 nfs/kdc.example.com@EXAMPLE.COM
3 nfs/kdc.example.com@EXAMPLE.COM
klist -k on client:
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
2 host/client.example.com@EXAMPLE.COM
2 host/client.example.com@EXAMPLE.COM
2 host/client.example.com@EXAMPLE.COM
2 nfs/client.example.com@EXAMPLE.COM
2 nfs/client.example.com@EXAMPLE.COM
2 nfs/client.example.com@EXAMPLE.COM
kadmin -p root/admin:
kadmin: listprincs
K/M@EXAMPLE.COM
edrive@EXAMPLE.COM
host/client.example.com@EXAMPLE.COM
host/kdc.example.com@EXAMPLE.COM
kadmin/admin@EXAMPLE.COM
kadmin/changepw@EXAMPLE.COM
kadmin/example.com@EXAMPLE.COM
krbtgt/EXAMPLE.COM@EXAMPLE.COM
nfs/client.example.com@EXAMPLE.COM
nfs/kdc.example.com@EXAMPLE.COM
root/admin@EXAMPLE.COM
So, what the issue is? Why I cannot mount my NFS share?
Best Answer
I got the same issue. According to this smal tutorial https://www.certdepot.net/rhel7-use-kerberos-control-access-nfs-network-shares/ you should enable nfs-secure-server service in server side and nfs-secure service in client side. This should solve the problem.