<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hello,</span></div><div><br><span></span></div><div><span>do you mean to run only this on the nfs-server?<br></span></div><div><br><span></span></div><div>ipa-getkeytab -s <a target="_blank" href="http://my.ipaserver.edu/">my.ipaserver.edu</a> -p nfs/<a href="mailto:my.nfsserve.edu@MYREALM.EDU">my.nfsserve.edu@MYREALM.EDU</a> -k /etc/krb5.keytab</div><div><br></div><div>Rob says to run ipa-getkeytab on each machine... So I guess I should run the above command on the ipa-server before I run it on the nfs-server?</div><div>Otherwise it seems to me the nfs-server won't know the new keytab in /tmp/ on the ipa-server.</div><div><br></div><div>Thanks,</div><div>George</div><div><br></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight: bold;">From:</span></b> Simo Sorce <simo@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> george he <george_he7@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, June 29, 2012 10:53 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] nfs server<br> </font> </div> <br> On Fri, 2012-06-29 at 07:45 -0700, george he wrote:<br>> Hello Simo,<br>> <br>> <br>> So you mean I should run<br>> <br>> <br>> ipa-getkeytab -s <a target="_blank" href="http://my.ipaserver.edu/">my.ipaserver.edu</a> -p nfs/<a ymailto="mailto:my.nfsserve.edu@MYREALM.EDU" href="mailto:my.nfsserve.edu@MYREALM.EDU">my.nfsserve.edu@MYREALM.EDU</a><br>> -k /tmp/krb5.keytab<br>> <br>> <br>> on the ipa-server, and <br><br><br>You should run the command only once (running more than once will simply<br>invalidate whatever you downloaded in previous runs), preferably on the<br>target server so you avoid the need of transfering keytab files around.<br>> <br>> <br>> ipa-getkeytab -s my.ipaserver.edu -p nfs/<a ymailto="mailto:my.nfsserve.edu@MYREALM.EDU" href="mailto:my.nfsserve.edu@MYREALM.EDU">my.nfsserve.edu@MYREALM.EDU</a><br>> -k my.ipaserver.edu:/tmp/krb5.keytab<br>> <br>> <br>> on the nfs-server? where /tmp/krb5.keytab is the key generated on the<br>> ipa-server for nfs.<br><br>If you have ipa-getkeytab on the target server (<a target="_blank" href="http://my.nfsserve.edu/">my.nfsserve.edu</a>) in your<br>case just run it there and point it at /etc/krb5.keytab directly.<br><br>The ipa-getkeytab command does not rewrite the file it appends the new<br>keys there, which is what you want.<br><br><br>Simo.<br><br><br>-- <br>Simo Sorce * Red Hat, Inc * New York<br><br><br><br> </div> </div> </blockquote></div> </div></body></html>