Thank you Kevin and Willam.
Yes, I am dealing with Heimdal KDC.
Are there someone who is running NFS with Heimdal KDC?
2010/6/24 Kevin Coffman <kwc@xxxxxxxxxxxxxx>:
> (Resending in plain text so the mailing list will accept it!)
>
> I think he is dealing with a Heimdal KDC; not Heimdal libraries on the
> client machine.
>
> It is true that gssd no longer works with Heimdal libraries, but it
> should work against a Heimdal KDC.
>
> I am not sure about working with IPv6, though.
>
> On Wed, Jun 23, 2010 at 10:46 AM, William A. (Andy) Adamson
> <androsadamson@xxxxxxxxx> wrote:
>>
>> I don't think that gssd works with Heimdal.
>>
>> -->Andy
>>
>> On Tue, Jun 22, 2010 at 10:36 AM, yagi shinnosuke <linus404@xxxxxxxxx> wrote:
>> > Hello.
>> >
>> > Thank you Jeff.
>> >
>> > I could run kinit and got TGT of nfs/nfsserv.localdomain
>> > However, mountig was failed again.
>> >
>> >
>> > My KDC working on NFS server (FreeBSD 8.0).
>> > Version is Heimdal 1.1.0.
>> > ======================================================================
>> > nfsserv# /usr/libexec/kdc --version
>> > kdc (Heimdal 1.1.0)
>> > Copyright 1995-2008 Kungliga Tekniska H▒gskolan
>> > Send bug-reports to heimdal-bugs@xxxxxxx
>> > ======================================================================
>> >
>> >
>> > When I run rpc.gssd with -n flag, error output of rpc.gssd and
>> > output of klist changed.
>> > (but I cannot mount yet.)
>> >
>> > Output of klist on client.
>> > ======================================================================
>> > [root@fedoravm ~]# klist
>> > Ticket cache: FILE:/tmp/krb5cc_0
>> > Default principal: nfs/fedoravm.localdomain@NWBOOT
>> >
>> > Valid starting Expires Service principal
>> > 06/21/10 09:13:18 06/22/10 09:13:18 krbtgt/NWBOOT@NWBOOT
>> > renew until 06/28/10 09:13:18
>> > 06/21/10 09:14:41 06/22/10 09:13:18 nfs/nfsserv.localdomain@NWBOOT
>> > renew until 06/28/10 09:13:18
>> > ======================================================================
>> >
>> > Result of mount.
>> > ======================================================================
>> > [root@fedoravm ~]# mount -v -t nfs nfsserv.localdomain:/export/work
>> > /mnt/nfs/ -o sec=krb5,vers=3
>> > mount.nfs: timeout set for Mon Jun 21 10:21:56 2010
>> > mount.nfs: trying text-based options
>> > 'sec=krb5,vers=3,addr=2002:192:168:1:217:a4ff:fe20:e5f0'
>> > mount.nfs: prog 100003, trying vers=3, prot=6
>> > mount.nfs: trying 2002:192:168:1:217:a4ff:fe20:e5f0 prog 100003 vers 3
>> > prot TCP port 2049
>> > mount.nfs: prog 100005, trying vers=3, prot=17
>> > mount.nfs: trying 2002:192:168:1:217:a4ff:fe20:e5f0 prog 100005 vers 3
>> > prot UDP port 818
>> > mount.nfs: mount(2): Permission denied
>> > mount.nfs: access denied by server while mounting
>> > nfsserv.localdomain:/export/work
>> > ======================================================================
>> >
>> >
>> > Error output of rpc.gssd
>> > ======================================================================
>> > creating context using fsuid 0 (save_uid 0)
>> > creating tcp client for server nfsserv.localdomain
>> > DEBUG: port already set to 2049
>> > creating context with server nfs@xxxxxxxxxxxxxxxxxxx
>> > WARNING: Failed to create krb5 context for user with uid 0 for server
>> > nfsserv.localdomain
>> > WARNING: Failed to create krb5 context for user with uid 0 for server
>> > nfsserv.localdomain
>> > doing error downcall
>> > destroying client /var/lib/nfs/rpc_pipefs/nfs/clnt58
>> > destroying client /var/lib/nfs/rpc_pipefs/nfs/clnt57
>> > ======================================================================
>> >
>> > It seems that I cannot get permisson to accsess filesystems
>> > by root (uid 0).
>> > Do I miss some necessary settings?
>> >
>> > Settings for Kerberos is follow.
>> >
>> > /etc/krb5.conf on server
>> > ======================================================================
>> > nfsserv# cat /etc/krb5.conf
>> > [libdefaults]
>> > default_realm = NWBOOT
>> > [realms]
>> > NWBOOT = {
>> > kdc = nfsserv.localdomain
>> > admin_server = nfsserv.localdomain
>> > kpasswd_server = nfsserv.localdomain
>> > }
>> > [domain_realm]
>> > nfsserv.localdomain = NWBOOT
>> > .nfsserv.localdomain = NWBOOT
>> > localdomain = NWBOOT
>> > .localdomain = NWBOOT
>> > [logging]
>> > kdc = FILE:/var/log/krb5kdc.log
>> > admin_server = FILE:/var/log/kadmin.log
>> > default = FILE:/var/log/krb5lib.log
>> > ======================================================================
>> >
>> > /etc/krb5.conf on client
>> > ======================================================================
>> > [root@fedoravm ~]# cat /etc/krb5.conf
>> > [logging]
>> > default = FILE:/var/log/krb5libs.log
>> > ccache_type = 4
>> > allow_weak_crypto=true
>> >
>> > [libdefaults]
>> > default_realm = NWBOOT
>> > dns_lookup_realm = false
>> > dns_lookup_kdc = false
>> > ticket_lifetime = 24h
>> > renew_lifetime = 7d
>> > forwardable = true
>> >
>> > [realms]
>> > NWBOOT = {
>> > kdc = nfsserv.localdomain
>> > admin_server = nfsserv.localdomain
>> > kpasswd_server = nfsserv.localdomain
>> > default_domain = localdomain
>> > }
>> >
>> > [domain_realm]
>> > .localdomain = NWBOOT
>> > localdomain = NWBOOT
>> > .nfsserv.localdomain = NWBOOT
>> > nfsserv.localdomain = NWBOOT
>> > ======================================================================
>> >
>> >
>> > Thanks.
>> >
>> > Jeff Layton さんは書きました:
>> >>
>> >> On Fri, 18 Jun 2010 07:27:18 +0900
>> >> yagi shinnosuke <linus404@xxxxxxxxx> wrote:
>> >>
>> >>> Hello.
>> >>>
>> >>> I have been trying to set up kerberized nfsv3 server and clients over IPv6
>> >>> network, but run into a few problems.
>> >>>
>> >>> When I try to mount NFS share, an error "permission denied." occured and
>> >>> failed to mount.
>> >>>
>> >>> My server is FreeBSD8. My client is Fedora 13.
>> >>> Without Kerberos, I can mount NFS share.
>> >>>
>> >>> Output of mount command is follow
>> >>> =============================================================================================
>> >>> # mount -t nfs nfsserv.localdomain:/export/work /mnt/nfs/ -o
>> >>> sec=krb5,vers=3 -v
>> >>> mount.nfs: timeout set for Tue Jun 15 10:54:11 2010
>> >>> mount.nfs: trying text-based options
>> >>> 'sec=krb5,vers=3,addr=2002:192:168:1:217:a4ff:fe20:e5f0'
>> >>> mount.nfs: prog 100003, trying vers=3, prot=6
>> >>> mount.nfs: trying 2001:XXXX::a4ff:fe20:e5f0 prog 100003 vers 3 prot TCP
>> >>> port 2049
>> >>> mount.nfs: prog 100005, trying vers=3, prot=17
>> >>> mount.nfs: trying 2001:XXXX::a4ff:fe20:e5f0 prog 100005 vers 3 prot UDP
>> >>> port 818
>> >>> mount.nfs: mount(2): Permission denied
>> >>> mount.nfs: access denied by server while mounting
>> >>> nfsserv.localdomain:/export/work
>> >>> ==============================================================================================
>> >>>
>> >>> "nfsserv is hostname of NFS server and 2001:XXXX::a4ff:fe20:e5f0 is
>> >>> its IPv6 address.
>> >>>
>> >>>
>> >>> I run rpc.gssd with -vvvvv options, and I got following warnings.
>> >>> ==============================================================================================
>> >>> creating context with server nfs@xxxxxxxxxxxxxxxxxxx
>> >>> WARNING: Failed to create krb5 context for user with uid 0 for server
>> >>> nfsserv.localdomain
>> >>> WARNING: Failed to create machine krb5 context with credentials cache
>> >>> FILE:/tmp/krb5cc_machine_NWBOOT for server nfsserv.localdomain
>> >>> WARNING: Failed to create machine krb5 context with any credentials
>> >>> cache for server nfsserv.localdomain
>> >>> doing error downcall
>> >>> ==============================================================================================
>> >>>
>> >>> It seems that rpc.gssd could not create credentials for nfsserver.
>> >>> However, I run kinit correctly on client.
>> >>>
>> >>> My kinit and klist results are follow.
>> >>> ==============================================================================================
>> >>> [root@fedoravm]# kinit root
>> >>> Password for root@NWBOOT:
>> >>> [root@fedoravm]# klist
>> >>> Ticket cache: FILE:/tmp/krb5cc_0
>> >>> Default principal: root@NWBOOT
>> >>>
>> >>> Valid starting Expires Service principal
>> >>> 06/15/10 16:53:22 06/16/10 16:53:15 krbtgt/NWBOOT@NWBOOT
>> >>> renew until 06/22/10 16:53:15
>> >>> ==============================================================================================
>> >>>
>> >>> I read following page and added root keytab to client, but nothing changed.
>> >>> http://www.mail-archive.com/linux-nfs@xxxxxxxxxxxxxxx/msg01360.html
>> >>>
>> >>> My Client Keytab:
>> >>> ==============================================================================================
>> >>> [root@fedoravm]# ktutil
>> >>> ktutil: rkt /etc/krb5.keytab
>> >>> ktutil: list -e
>> >>> slot KVNO Principal
>> >>> ---- ----
>> >>> ---------------------------------------------------------------------
>> >>> 1 1 nfs/fedoravm.localdomain@NWBOOT (DES cbc mode with
>> >>> CRC-32)
>> >>> 2 1 root/fedoravm.localdomain@NWBOOT (DES cbc mode with
>> >>> CRC-32)
>> >>> 3 1 host/fedoravm.localdomain@NWBOOT (DES cbc mode with
>> >>> CRC-32)
>> >>> ==============================================================================================
>> >>>
>> >>> My Server Keytab:
>> >>> ==============================================================================================
>> >>> nfsserv# ktutil list
>> >>> FILE:/etc/krb5.keytab:
>> >>>
>> >>> Vno Type Principal
>> >>> 1 des-cbc-crc nfs/nfsserv.localdomain@NWBOOT
>> >>> 1 des-cbc-crc root/nfsserv.localdomain@NWBOOT
>> >>> 1 des-cbc-crc host/nfsserv.localdomain@NWBOOT
>> >>> ==============================================================================================
>> >>>
>> >>>
>> >>> I have surveyed web pages to find nothing about Kerberized NFS over IPv6.
>> >>> I'm not sure it works or not.
>> >>> Does rpc.gssd works on IPv6 enviromnent?
>> >>>
>> >>> Can anybody give me any hints or suggestions?
>> >>>
>> >>
>> >> It should work. If you run something like:
>> >>
>> >> # kinit -k nfs/fedoravm.localdomain
>> >>
>> >> ...does that get you a TGT? What kind of KDC is this?
>> >>
>> >
>
��.n��������+%������w��{.n�����{��w��� jg��� �����ݢj����G���� ���j:+v���w�m������w�������h�����٥
