<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hello Simo,</span></div><div><br><span></span></div><div><span>So you mean I should run</span></div><div><br><span></span></div><div><span>ipa-getkeytab -s my.ipaserver.edu -p nfs/my.nfsserve.edu@MYREALM.EDU -k /tmp/krb5.keytab</span></div><div><br><span></span></div><div><span>on the ipa-server, and <br></span></div><div><br><span></span></div><div><span>ipa-getkeytab -s my.ipaserver.edu -p nfs/my.nfsserve.edu</span><span>@MYREALM.EDU</span><span> -k </span><span>my.ipaserver.edu:</span><span>/tmp/krb5.keytab</span></div><div><br></div><div>on the nfs-server? where <span>/tmp/krb5.keytab is the key generated on the ipa-server for nfs.</span></div><div><br><span></span></div><div><span>Thanks,</span></div><div><span>George</span></div><div><span><br></span></div><div><br></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight: bold;">From:</span></b> Simo Sorce <simo@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> george he <george_he7@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, June 29, 2012 10:24 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] nfs server<br> </font> </div> <br> On Fri, 2012-06-29 at 07:18 -0700, george he wrote:<br>> Hello all,<br>> <br>> <br>> Now I have an ipa server and a few ipa clients set up, I need to set<br>> up an nfs server on one of the ipa-clients.<br>> I'm following the instructions here<br>> <a href="https://docs.fedoraproject.org/en-US/Fedora/16/html/FreeIPA_Guide/Installing_the_IPA_Client_on_Linux.html" target="_blank">https://docs.fedoraproject.org/en-US/Fedora/16/html/FreeIPA_Guide/Installing_the_IPA_Client_on_Linux.html</a><br>> where at 8.c and 8.d, it says<br>> <br>> <br>> scp /tmp/krb5.keytab <a ymailto="mailto:root@nfs.example.com" href="mailto:root@nfs.example.com">root@nfs.example.com</a>:/etc/krb5.keytab<br>> <br>> and <br>> <br>> scp /tmp/krb5.keytab <a ymailto="mailto:root@client.example.com" href="mailto:root@client.example.com">root@client.example.com</a>:/etc/krb5.keytab<br>> <br>> <br>> <br>> But the file /etc/krb5.keytab already exists on both of the ipa-server<br>> and the nfs-server.<br>> Should I just over-write the existing keytabs?<br><br>No, you should not overwrite them if they contain the host keytab.<br><br>If they are ipa clients and you can install admin tools you can simply<br>run the ipa-getkeytab command on the right machine directly.<br><br>if you can't for whatever reason you should copy the new keytab to the<br>machine in a temporary (but protected) location like /root/nfs.keytab<br><br>Then use the ktutil tool to merge the 2 keytab files<br>into /etc/krb5.keytab<br><br>ktutil is not the most intuitive tool, but the documentation should be<br>good enough to sort out what you need to do.<br><br>Simo.<br><br>-- <br>Simo Sorce * Red Hat, Inc * New York<br><br><br><br> </div> </div> </blockquote></div> </div></body></html>