On Thu, Apr 07, 2011 at 01:24:18PM -0300, fernando@xxxxxxxxxxxxx wrote: > Hi there, > I need to use OpenVPN to get to the company LAN and mount a NFS share. > We use NFS to secure access to NFS. I can connect to the PVN and access > web and ssh servers. Kinit to my own principal works fine. But root > cannot get a valid kerneros ticket to mount NFS shares. I already tried > doing the same on the local net (no VPN involved) with same results, > and tried disabling SELinux and flusing iptables rules to no effect. > Another notebook works fine and it looks to me both have the same > settings, except one has F13 (the one that works) and the other has F14 > (the one that doesn't). > I added -v -v to rpcgssd and the logs show that: > Apr 7 09:36:29 lgx200 rpc.gssd[2947]: handling gssd upcall > (/var/lib/nfs/rpc_pipefs/nfs/clnt0) > Apr 7 09:36:29 lgx200 rpc.gssd[2947]: handle_gssd_upcall: 'mech=krb5 > uid=0 enctypes=18,17,16,23,3,1,2 ' > Apr 7 09:36:29 lgx200 rpc.gssd[2947]: handling krb5 upcall > (/var/lib/nfs/rpc_pipefs/nfs/clnt0) > Apr 7 09:36:29 lgx200 rpc.gssd[2947]: process_krb5_upcall: service is > '<null>' > Apr 7 09:36:40 lgx200 rpc.gssd[2947]: WARNING: Key table entry not > found while getting initial ticket for principal > 'nfs/lg.example.com@USERS' using keytab 'WRFILE:/etc/krb5.keytab' > Apr 7 09:36:40 lgx200 rpc.gssd[2947]: ERROR: No credentials found for > connection to server filesystem.example.com > Apr 7 09:36:40 lgx200 rpc.gssd[2947]: doing error downcall > [all output was edted to change my employee dns domain name to > example.com] > But the correct ticket (certificate?) is on the keytab, as shown by > klist: > [root@lg etc]# hostname > lg > [root@lg etc]# klist -k > Keytab name: WRFILE:/etc/krb5.keytab > KVNO Principal > ---- > ----------------------------------------------------------------------- > --- > 2 nfs/lg.example.com@USERS > Any idea one notebook can mount and authenticate root/the computer > itself using kerberos, but the other, older Fedora can't, using the > same configs? Use "klist -k -e" to check the type of key you have. If it's DES, and you don't have "allow_weak_crypto" enabled in the [libdefaults] section of your /etc/krb5.conf, the key will be skipped over. This is something that changed between the versions included in F13 and F14, so from what I can tell, it fits. HTH, Nalin -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
