On Thu, 6 Jun 2013, Ritter, Marcel wrote:
> Newer versions of nfs-utils (>= 1.2.4) support the HOSTNAME$ format
> (treated like a UPN) used by Samba/Windows, which makes things easier
> (and could/should work out of the box with a keytab created by samba
> itself).
I have tried creating a Samba4 user object with a suitable UPN using
msktutil on the DC (this is successfully entered into the database):
# OU=Computers
# HOST=<short hostname>
# msktutil -c -b CN=$OU \
-k nfs-$HOST.keytab \
--computer-name nfs-$HOST \
--upn nfs/$HOST.test.cornell.edu \
--service nfs/$HOST.test.cornell.edu \
--server `hostname` \
--dont-expire-password \
--hostname $HOST.test.cornell.edu \
--enctypes 0x3
and then importing this keytab into the host's keytab with ktutil (so, not
using "net ads keytab add"). Verified the keytab with klist. Get
permission denied when trying to mount with sec=krb5. Various different
enctypes all get the same result.
I tried also building nfs-utils 1.2.8 from source and installing that on
the NFSv4 server (using the NFSv4 server as a client for this test). All
I get then, no matter what I put in the keytab, is:
rpc.gssd[1679]: ERROR: GSS-API: error in gss_set_allowable_enctypes(): GSS_S_BAD_MECH
(An unsupported mechanism was requested) - Unknown error
The build of nfs-utils (via rpmbuild) appeared clean but I suspect that
there may be something wrong with it. Still using the 2.6.32-358.6.2.el6
kernel.
I tried the workaround suggested in:
https://bugzilla.redhat.com/show_bug.cgi?id=720479
just in case, but it made no difference.
Running out of ideas!
-Steve
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
