problems with sec=krb5
Rohit Kumar Mehta
rohitm at engr.uconn.edu
Wed Mar 28 13:35:29 EDT 2007
I noticed there were quite a few rpc.gssd processes running so I
rebooted, and now it appears to have made the correct
krb5cc_machine_AD.ENGR.UCONN.EDU file.
The behavior is still similar, however. (sec=sys mounts work, but
sec=krb5 mounts do not). I'm not sure why I'm getting the warning about
rpc.gssd not running when it clearly is running as well.
root at cselin12:~# mount -t nfs4 -o sec=krb5
filesm:/StaffDirectories/nfs/rohitm /home/rohitm
Warning: rpc.gssd appears not to be running.
mount: block device filesm:/StaffDirectories/nfs/rohitm is
write-protected, mounting read-only
Warning: rpc.gssd appears not to be running.
mount: cannot mount block device filesm:/StaffDirectories/nfs/rohitm
read-only
root at cselin12:~# ps awwux |grep rpc.gssd
root 3841 0.0 0.1 11848 1552 ? Ss 13:11 0:00
rpc.gssd -vvvv
Also in the daemon.log now we find some more interesting output:
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: processing client list
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: handling krb5 upcall
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: Using keytab file
'/etc/krb5.keytab'
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: INFO: Credentials in CC
'FILE:/tmp/krb5cc_machine_AD.ENGR.UCONN.EDU' are good until 1
175137866
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: using
FILE:/tmp/krb5cc_machine_AD.ENGR.UCONN.EDU as credentials cache for
machine cre
ds
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: creating context using euid 0
(save_uid 0)
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: creating tcp client for server
filesm
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: creating context with server
nfs at filesm
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: WARNING: Failed to create krb5
context for user with uid 0 for server filesm
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: WARNING: Failed to create krb5
context for user with uid 0 with credentials cache FIL
E:/tmp/krb5cc_machine_AD.ENGR.UCONN.EDU for server filesm
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: WARNING: Failed to create krb5
context for user with uid 0 with any credentials cache
for server filesm
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: doing error downcall
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: processing client list
Mar 28 13:21:18 cselin12 last message repeated 2 times
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: handling krb5 upcall
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: Using keytab file
'/etc/krb5.keytab'
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: INFO: Credentials in CC
'FILE:/tmp/krb5cc_machine_AD.ENGR.UCONN.EDU' are good until 1
175137866
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: using
FILE:/tmp/krb5cc_machine_AD.ENGR.UCONN.EDU as credentials cache for
machine cre
ds
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: creating context using euid 0
(save_uid 0)
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: creating tcp client for server
filesm
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: creating context with server
nfs at filesm
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: WARNING: Failed to create krb5
context for user with uid 0 for server filesm
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: WARNING: Failed to create krb5
context for user with uid 0 with credentials cache FIL
E:/tmp/krb5cc_machine_AD.ENGR.UCONN.EDU for server filesm
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: WARNING: Failed to create krb5
context for user with uid 0 with any credentials cache
for server filesm
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: doing error downcall
Mar 28 13:21:18 cselin12 rpc.gssd[3841]: processing client list
I have the user rohitm's kerberos credentials, and he owns all the files
in /StaffDirectories/nfs/rohitm. rohitm is also UID 6557 in NIS, but it
seems to be trying use the ID of root who is making the mount. I'm not
sure if there is some configuration problem I am missing here.
I believe I created the nfs/cselin service principal des-cbc-crc:
root at cselin12:/etc# klist -e -k
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
----
------------------------------------------------------------------------
7 host/cselin12.engr.uconn.edu at AD.ENGR.UCONN.EDU (DES cbc mode with
RSA-MD5)
9 nfs/cselin12.engr.uconn.edu at AD.ENGR.UCONN.EDU (DES cbc mode with
CRC-32)
Now one thing I might have done wrong is mapping both the
host/cselin12.engr.uconn.edu and the nfs/cselin12.engr.uconn.edu service
principals to the same username in the Active Directory. I am not sure
if that is a problem or not.
Right now the nfs-utils is the standard one that comes with Ubuntu
Dapper. It appears to be 1.0.7-3ubuntu2.
Attached are the tcpdumps gssd.nfs.pcap (communications to nfs server 88
packets) and gssd.kdc.pcap (communications to kdc 0 packets).
Thanks so much for your help!
Rohit
Kevin Coffman wrote:
> On 3/28/07, Rohit Kumar Mehta <rohitm at engr.uconn.edu> wrote:
>
>>
>> I did create it in AD and add it to the /etc/krb5.keytab.
>>
>
> Your keytab looks OK (assuming that lone nfs key is des-cbc-crc)
> ("klist -e -k" as root)
> Your krb5.conf file looks OK.
>
> What version of nfs-utils are you using and what options are you
> specifying to gssd? If you have a newer version of nfs-utils and
> using a memory credentials cache, that may explain why the
> krb5cc_machine_REALM ccache is not being seen in /tmp. If that is the
> case, you might drop "-M" option temporarily until we figure out the
> problem.
>
> It would be interesting to see what kind of service ticket the client
> is requesting. Could you get a network trace from the client with
> traffic between it and both the KDC and the NFS server? Get the trace
> from gssd startup through the mount attempt.
> tcpdump -s0 -w /tmp/gssd.pcap host KDC-HOST or host NFS-SERVER
>
> K.C.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gssd.nfs.pcap
Type: application/octet-stream
Size: 10584 bytes
Desc: not available
Url : http://linux-nfs.org/pipermail/nfsv4/attachments/20070328/68f9fd36/attachment.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gssd.kdc.pcap
Type: application/octet-stream
Size: 24 bytes
Desc: not available
Url : http://linux-nfs.org/pipermail/nfsv4/attachments/20070328/68f9fd36/attachment-0001.obj
More information about the NFSv4
mailing list