On Sat, 8 Jun 2013, Steve Thompson wrote:
> Running out of ideas!
Well, I managed to solve this one. It turned out to be nothing to do with
Samba4, nor the version of nfs-utils (1.2.3-36) or the version of the
kernel (2.6.32-358.6.2.el6) on the NFS server and client. It was in the
/etc/exports file; I was exporting /mnt/exports (the NFSv4 root with
fsid=0) with sec=sys:krb5 and /mnt/exports/data (a file system), also with
sec=sys:krb5, but also /mnt/data (the real file system, which is
bind-mounted on to /mnt/exports/data), this time without specifying sec=.
The latter was as a service to clients using NFSv3. It transpired that by
adding sec=sys:krb5 to the latter export, the NFSv4+krb5 mounts all
started working. I could argue that this is a bug, but whatever, it is now
working.
Notes:
* allow_weak_crypto=yes is REQUIRED in krb5.conf for this software version
combo.
* a separate user object is REQUIRED with the UPN nfs/fqdn. I add this
using msktutil on the client when the client is joined to the domain.
Using "net ads keytab add nfs" is NOT sufficient, since it adds an
SPN and not a UPN.
Steve
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
