Hi all,
I'm a newbie starting to play around with kerberized nfs on Debian. I
noticed that in the systemd target file nfs-client.target
<http://git.linux-nfs.org/?p=steved/nfs-utils.git;a=blob;f=systemd/nfs-client.target;h=8a8300a1dfc6e6a77dfe0abed9942ded8f6b0103;hb=refs/heads/master>
has *rpc-svcgssd* among its list of dependencies. From the man pages
<https://linux.die.net/man/8/rpc.svcgssd>, it seems this is a
server-side daemon, not client-, and as expected I don't seem to need it
for the clients to mount anything successfully. Why is this part of the
client target?
I thought it may be a dependency for something else, but I haven't been
able to find what. Similarly, why is it installed with the *nfs-common*
package instead of *nfs-kernel-server* if it's not needed?
This came up because I kept seeing errors on boot caused by rpc.svcgssd
looking for nfs//FQDN/@/REALM /in the keytab, but it doesn't exist.
rpc.gssd, on the other hand, was updated
<https://linux.die.net/man/8/rpc.gssd> to search for other principals,
like host/FQDN@REALM, which is what gets set up in the keytab by default.
Thanks,
Aram
> On Sep 27, 2022, at 4:21 PM, Aram Akhavan <[email protected]> wrote:
>
> Hi all,
>
> I'm a newbie starting to play around with kerberized nfs on Debian. I noticed that in the systemd target file nfs-client.target <http://git.linux-nfs.org/?p=steved/nfs-utils.git;a=blob;f=systemd/nfs-client.target;h=8a8300a1dfc6e6a77dfe0abed9942ded8f6b0103;hb=refs/heads/master> has *rpc-svcgssd* among its list of dependencies. From the man pages <https://linux.die.net/man/8/rpc.svcgssd>, it seems this is a server-side daemon, not client-, and as expected I don't seem to need it for the clients to mount anything successfully. Why is this part of the client target?
>
> I thought it may be a dependency for something else, but I haven't been able to find what. Similarly, why is it installed with the *nfs-common* package instead of *nfs-kernel-server* if it's not needed?
>
> This came up because I kept seeing errors on boot caused by rpc.svcgssd looking for nfs//FQDN/@/REALM /in the keytab, but it doesn't exist. rpc.gssd, on the other hand, was updated <https://linux.die.net/man/8/rpc.gssd> to search for other principals, like host/FQDN@REALM, which is what gets set up in the keytab by default.
An NFSv4 client has a small NFS server in it that handles callback operations.
For NFSv4.0, this server can support the use of GSS/Kerberos on the backchannel
connection.
I thought gssproxy made svcgssd obsolete, but I'm probably misinformed.
--
Chuck Lever