Hi folks,
My site already has a working Kerberos system that allows users to access
various services. To this end, all hosts already have a host/<hostname>
principal with a full set of cryptographic keys. On the servers, besides
the host keys in /etc/krb5.keytab, each Kerberized service has its own
keytab: some with a full set of keys and others with only one (= weak
crypto). Separate keytab files are maintained to prevent services from
reading the wrong keys.
Therefore, on each of my servers the single key for NFSv4 will also need
to be kept separate. With many Kerberized services, the Kerberos realm,
service name and keytab file location can be specified somewhere. With
others, the realm and service name are deduced from the contents of the
keytab, but almost always the keytab location must be set somewhere: in a
configuration file, or even with an environment variable. So how can this
be configured for NFSv4?
Thanks,
Jaap