Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Sun, 22 Jan 2023 12:43:13 +0800
From:   Wang Yugui <wangyugui@e16-tech.com>
To:     linux-nfs@vger.kernel.org
Subject: any guide to install/test nfs sec=krb5?
Message-Id: <20230122124313.31CB.409509F4@e16-tech.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Precedence: bulk

Hi,

Is there any guide to install/test nfs sec=krb5?

test env:
krb5 server : windows  active directory
linux: rocky linux 9.1,  already 'realm join' with sssd.

1) from redhat
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_and_using_network_file_services/securing-nfs_configuring-and-using-network-file-services
Procedure
Create the nfs/hostname.domain@REALM principal on the NFS server side.
Create the host/hostname.domain@REALM principal on both the server and the client side.
Add the corresponding keys to keytabs for the client and server.

but we need more detail.


2, from isilon
http://doc.isilon.com/ECS/3.3/AdminGuide/ecs_t_file_access_confgure_kerberos.html
http://doc.isilon.com/ECS/3.7/AdminGuide/GUID-2018CF69-5F1E-4F3A-BA90-3659F85DE415.html
more detail than redhat.

but the following fail.
Test registration by running.
kinit -k host/<fqdn>@NFS-REALM.LOCAL

host/<fqdn> will is already created when 'realm join'?
host/<fqdn> is created here again, so there is some trouble?

'kinit -k nfs/<fqdn>@NFS-REALM.LOCAL' works as the document.


any guide please, thanks a lot.

Best Regards
Wang Yugui (wangyugui@e16-tech.com)
2023/01/22