On 07/13/2011 12:03 PM, Benjamin Coddington wrote: > I am working on a linux NFS cluster that requires a single svcgssd to establish contexts under multiple service names. > > In this scenario, svcgssd can be called with "-n" so that it acquires creds at context creation. After running this way I found svcgssd opens a file to the kerberos replay cache for every context/cred, eventually reaching ulimit. For a busy cluster with many different client-user pairs that becomes a problem. I am lost in the gss_krb5 code, but suspect that the kerberos code leaks credentials in this configuration. > > Ondrej Palkovsky submitted a patch to specify multiple identities and acquire creds up-front using multiples of "-h": http://marc.info/?l=linux-nfsv4&m=123685185324902&w=2 > > I've updated that work to be current to nfs-utils-1.2.3 which solves our immediate problem, and it works well Please go a head are repost the updated patch... Also it good if there was a man page updated was well... tia, steved. -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
