From: Chuck Lever <chuck.lever@oracle.com>
Content-Type: text/plain; charset=us-ascii
Subject: Configuring NFSv4.0 Kerberos on a multi-homed Linux NFS server
Message-Id: <DB5B2D02-412E-46AD-9F0A-7EBA4EB0C0B0@oracle.com>
Date: Thu, 5 May 2016 12:04:34 -0400
To: Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
Sender: linux-nfs-owner@vger.kernel.org

Hi-

I have a Linux NFS server with two IP addresses:

192.168.1.55: klimt.home
10.0.0.5: klimt-ib.home

The server's keytab lists three principals:

host/klimt.home@HOME.EXAMPLE.NET
nfs/klimt.home@HOME.EXAMPLE.NET
nfs/klimt-ib.home@HOME.EXAMPLE.NET

When I mount with this:

  vers=4.0,proto=tcp,sec=sys klimt:/export

I get krb5i for lease management, and sys for data traffic.
Callback traffic from the server uses krb5i. All well and
good.

When I mount with this:

  vers=4.0,proto=tcp,sec=sys klimt-ib:/export

I get krb5i for lease management and sys for data traffic
as before, and callback traffic attempts to use krb5i.
But the client rejects all CB_COMPOUND operations because
the callback principal does not match the clp.

Looks like the server always uses the nfs/klimt service
principal for callback traffic? Is there a way to config
the server to use the principal that matches the
interface? Or is there something else going on?

--
Chuck Lever