From: Kevin Coffman Subject: Re: Kerberized NFSv3 Client for Linux Date: Wed, 16 Feb 2005 09:49:27 -0500 Message-ID: <20050216144927.138341BB88@citi.umich.edu> References: <38c3c48605021405536f044f64@mail.gmail.com> <20050214150945.BAE461BAF7@citi.umich.edu> <38c3c4860502142059261a119a@mail.gmail.com> <20050215134718.59E051BB0B@citi.umich.edu> <38c3c48605021606265170db94@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: nfs@lists.sourceforge.net Received: from sc8-sf-mx1-b.sourceforge.net ([10.3.1.11] helo=sc8-sf-mx1.sourceforge.net) by sc8-sf-list2.sourceforge.net with esmtp (Exim 4.30) id 1D1QUc-0002IH-Sa for nfs@lists.sourceforge.net; Wed, 16 Feb 2005 06:49:30 -0800 Received: from citi.umich.edu ([141.211.133.111]) by sc8-sf-mx1.sourceforge.net with esmtp (TLSv1:AES256-SHA:256) (Exim 4.41) id 1D1QUb-0005pj-9I for nfs@lists.sourceforge.net; Wed, 16 Feb 2005 06:49:30 -0800 To: Suresh Jayaram In-reply-to: <38c3c48605021606265170db94@mail.gmail.com> Sender: nfs-admin@lists.sourceforge.net Errors-To: nfs-admin@lists.sourceforge.net List-Unsubscribe: , List-Id: Discussion of NFS under Linux development, interoperability, and testing. List-Post: List-Help: List-Subscribe: , List-Archive: Hi Suresh, Sounds like you've made a bit of progress. > Kevin, > > Thanks for the response. > On Tue, 15 Feb 2005 08:47:18 -0500, Kevin Coffman wrote: > > > Mount must be done by root. When a request comes up to rpc.gssd with > > uid 0 to negotiate a gss context, it uses a "machine credential" > > (nfs/@REALM) as the client principal. > > I created service(nfs) principal for both client and server > nfs/nfsclient.domain@REALM (extracted in client) > nfs/nfsserver.domain@REALM (extracted in server) > Is this correct? Yes, this is correct. > > Are you not doing the mount as root? > Iam Mounting as root only. > > Also I created /var/lib/nfs/rpc_pipefs. I am running "rpc.gssd -m" and > "rpc.idmapd" > Now iam able to mount > mount -osec=krb5 nfsserver:/exportedpath /mntpoint > But When I do an "ls /mntpoint" it hangs Is this still as root, or as a normal user? If as a normal user, had you already done a kinit to get a Kerberos TGT? > Also Iam getting the following in messages frequently > Feb 16 19:49:27 nfstest kernel: RPC: AUTH_GSS upcall timed out. > Feb 16 19:49:27 nfstest kernel: Please check user daemon is running! > > Any pointers ? This means that rpc.gssd probably stopped, or is hung up and no longer answering upcalls. Running rpc.gssd with option "-vvv" may give more clues. K.C. > Thanks, > Suresh > > > > > Iam trying to setup kerberized NFS(v3) client for Linux. > > > > > > > > > > My setup details > > > > > NFS client: Suse Linux Enterprise Server (SLES 9) which has > > > > > kernel - 2.6.5-7.97 (CONFIG_SUNRPC=y, CONFIG_SUNRPC_GSS=y, > > > > > CONFIG_RPCSEC_GSS_KRB5=y ) > > > > > > > > > > nfs-utils-1.0.7 (patched - nfs-utils-1.0.7-CITI_NFS4_ALL-1.dif) > > > > > util-linux-2.12 (patched - util-linux-2.12-CITI_NFS4_ALL-3.dif) > > > > > > > > > > KDC Server: RedHat Linux > > > > > NFS Server: Kerberized Solaris server (KDC Server & NFS Server are > > > > > Tested and working fine) > > > > > > > > > > To setup kerberized Linux Client, I presume a kernel with rpcsecgss > > > > > support, patched nfs-utils pkg and patched util-linux pkg is > > > > > sufficient. (Let me know any other pkg/configuration is required) > > > > > > > > > > My NFS Server export entry is: > > > > > share -F nfs -o sec=krb5 /export/home > > > > > > > > > > Server has nfs principal registered to KDC and the user principal of > > > > > client also registered to the Server. > > > > > After doing a kinit if I try to mount the exported path, Iam getting > > > > > > > > > > "mount: nfsserver:/export/home failed, reason given by server: > > > > > Permission denied" > > > > > Then I specified the client name in the exports file make gave > > > > > readonly perms. Then also I got the same error. > > > > > > > > > > Am I missing something ? Any pointers .. > > > > > > > > > > thanks, > > > > > Suresh > > > > > > > > > > > > > > > ------------------------------------------------------- > > > > > SF email is sponsored by - The IT Product Guide > > > > > Read honest & candid reviews on hundreds of IT Products from real use > rs. > > > > > Discover which products truly live up to the hype. Start reading now. > > > > > http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click > > > > > _______________________________________________ > > > > > NFS maillist - NFS@lists.sourceforge.net > > > > > https://lists.sourceforge.net/lists/listinfo/nfs > > > > > > > > > > > > > > > > > -- > > > "Good Luck is when preparation meets opportunity" > > > > > > > > > ------------------------------------------------------- > > > SF email is sponsored by - The IT Product Guide > > > Read honest & candid reviews on hundreds of IT Products from real users. > > > Discover which products truly live up to the hype. Start reading now. > > > http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click > > > _______________________________________________ > > > NFS maillist - NFS@lists.sourceforge.net > > > https://lists.sourceforge.net/lists/listinfo/nfs > > > > > > > -- > "Good Luck is when preparation meets opportunity" ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ NFS maillist - NFS@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfs