You use cross realm authentication, so that your NFS client may obtain tickets for servers that are not in its own realm. To allow for cross-realm authentication from your own MYREALM.NET (where te client is) to your neighbour's HISREALM.ORG (the realm of the server), you basically create *in*each*realm* a principal krbtgt/MYREALM.NET@xxxxxxxxxxxx. Both principals must be identical. They have to have the same name, the same encryption types, and the same kvno. After that, it's a matter of configuring the krb5.conf right: tell the Kerberos servers which machine is in which realm if DNS doesn't do that. Debian bug #571244 may also come into play on RHEL? I've got step by step documentation for an Ubuntu NFS client with Kerberos served by Heimdal under Debian and Windows AD respectively. But I haven't anonymized the text yet, so I can't put it online immediately. Would it help you if I anonymize it soon, or can you work it our from just the above hints? Regards Jurjen On 09/04/2014 11:04 AM, Cedric Blancher wrote: > How can I use NFS with kerberos krb5p auth when I want to use NFS > filesystems which come from different realms? > > I know klist -A can show all tickets I got from all realms I kinit to > - but how can NFS use them? > > OS is RHEL7 > > Ced > -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
