<div dir="ltr">I have used<br><br><pre class="programlisting">RPCGSSDARGS="-vvv" RPCSVCGSSDARGS="-vvv"<br><br></pre><pre class="programlisting">in <code class="filename">/etc/sysconfig/nfs</code> , as suggested in <a href="http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/Installing_the_IPA_Client_on_Linux.html">http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/Installing_the_IPA_Client_on_Linux.html</a><br><br></pre><pre class="programlisting">In the excerpt below, taken during the mount, meson is the client, spinque03 is the nfs server (synology).<br><br></pre><pre class="programlisting">It still doesn't tell me much, perhaps I'm missing something?<br></pre><br><span style="font-family:monospace,monospace">rpc.gssd[838]: handling gssd upcall (nfs/clnt19)<br>rpc.gssd[838]: handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 '<br>rpc.gssd[3328]: handling krb5 upcall (nfs/clnt19)<br>rpc.gssd[3328]: process_krb5_upcall: service is '<null>'<br>rpc.gssd[3328]: Full hostname for '<a href="http://spinque03.hq.spinque.com">spinque03.hq.spinque.com</a>' is '<a href="http://spinque03.hq.spinque.com">spinque03.hq.spinque.com</a>'<br>rpc.gssd[3328]: Full hostname for '<a href="http://meson.hq.spinque.com">meson.hq.spinque.com</a>' is '<a href="http://meson.hq.spinque.com">meson.hq.spinque.com</a>'<br>rpc.gssd[3328]: No key table entry found for MESON$@<a href="http://HQ.SPINQUE.COM">HQ.SPINQUE.COM</a> while getting keytab entry for 'MESON$@<a href="http://HQ.SPINQUE.COM">HQ.SPINQUE.COM</a>'<br>rpc.gssd[3328]: No key table entry found for root/<a href="mailto:meson.hq.spinque.com@HQ.SPINQUE.COM">meson.hq.spinque.com@HQ.SPINQUE.COM</a> while getting keytab entry for 'root/<a href="mailto:meson.hq.spinque.com@HQ.SPINQUE.COM">meson.hq.spinque.com@HQ.SPINQUE.COM</a>'<br>rpc.gssd[3328]: No key table entry found for nfs/<a href="mailto:meson.hq.spinque.com@HQ.SPINQUE.COM">meson.hq.spinque.com@HQ.SPINQUE.COM</a> while getting keytab entry for 'nfs/<a href="mailto:meson.hq.spinque.com@HQ.SPINQUE.COM">meson.hq.spinque.com@HQ.SPINQUE.COM</a>'<br>rpc.gssd[3328]: Success getting keytab entry for 'host/<a href="mailto:meson.hq.spinque.com@HQ.SPINQUE.COM">meson.hq.spinque.com@HQ.SPINQUE.COM</a>'<br>rpc.gssd[3328]: Successfully obtained machine credentials for principal 'host/<a href="mailto:meson.hq.spinque.com@HQ.SPINQUE.COM">meson.hq.spinque.com@HQ.SPINQUE.COM</a>' stored in ccache 'FILE:/tmp/<a href="http://krb5ccmachine_HQ.SPINQUE.COM">krb5ccmachine_HQ.SPINQUE.COM</a>'<br>rpc.gssd[3328]: INFO: Credentials in CC 'FILE:/tmp/<a href="http://krb5ccmachine_HQ.SPINQUE.COM">krb5ccmachine_HQ.SPINQUE.COM</a>' are good until 1439461246<br>rpc.gssd[3328]: using FILE:/tmp/<a href="http://krb5ccmachine_HQ.SPINQUE.COM">krb5ccmachine_HQ.SPINQUE.COM</a> as credentials cache for machine creds<br>rpc.gssd[3328]: using environment variable to select krb5 ccache FILE:/tmp/<a href="http://krb5ccmachine_HQ.SPINQUE.COM">krb5ccmachine_HQ.SPINQUE.COM</a><br>gssproxy[809]: (OID: { 1 2 840 113554 1 2 2 }) Unspecified GSS failure. Minor code may provide more information, No credentials cache found<br>gssproxy[798]: gssproxy[809]: (OID: { 1 2 840 113554 1 2 2 }) Unspecified GSS failure. Minor code may provide more information, No credentials cache found<br>rpc.gssd[3328]: creating tcp client for server <a href="http://spinque03.hq.spinque.com">spinque03.hq.spinque.com</a><br>rpc.gssd[3328]: DEBUG: port already set to 2049<br>rpc.gssd[3328]: creating context with server <a href="mailto:nfs@spinque03.hq.spinque.com">nfs@spinque03.hq.spinque.com</a><br>rpc.gssd[3328]: DEBUG: serialize_krb5_ctx: lucid version!<br>rpc.gssd[3328]: prepare_krb5_rfc4121_buffer: protocol 1<br>rpc.gssd[3328]: prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32<br>rpc.gssd[3328]: doing downcall: lifetime_rec=86399 acceptor=<a href="mailto:nfs@spinque03.hq.spinque.com">nfs@spinque03.hq.spinque.com</a><br>rpc.gssd[838]: handling gssd upcall (nfs/clnt19)<br>rpc.gssd[838]: handle_gssd_upcall: 'mech=krb5 uid=1005 enctypes=18,17,16,23,3,1,2 '<br>rpc.gssd[3337]: handling krb5 upcall (nfs/clnt19)<br>rpc.gssd[3337]: process_krb5_upcall: service is '<null>'<br>gssproxy[809]: (OID: { 1 2 840 113554 1 2 2 }) Unspecified GSS failure. Minor code may provide more information, No credentials cache found<br>gssproxy[798]: gssproxy[809]: (OID: { 1 2 840 113554 1 2 2 }) Unspecified GSS failure. Minor code may provide more information, No credentials cache found<br>rpc.gssd[3337]: creating tcp client for server <a href="http://spinque03.hq.spinque.com">spinque03.hq.spinque.com</a><br>rpc.gssd[3337]: DEBUG: port already set to 2049<br>rpc.gssd[3337]: creating context with server <a href="mailto:nfs@spinque03.hq.spinque.com">nfs@spinque03.hq.spinque.com</a><br>rpc.gssd[3337]: DEBUG: serialize_krb5_ctx: lucid version!<br>rpc.gssd[3337]: prepare_krb5_rfc4121_buffer: protocol 1<br>rpc.gssd[3337]: prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32<br>rpc.gssd[3337]: doing downcall: lifetime_rec=85675 acceptor=<a href="mailto:nfs@spinque03.hq.spinque.com">nfs@spinque03.hq.spinque.com</a></span><br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On 12 August 2015 at 02:46, Roberto Cornacchia <span dir="ltr"><<a href="mailto:roberto.cornacchia@gmail.com" target="_blank">roberto.cornacchia@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>I am trying to use a Synology NAS station in my FreeIPA domain to host automounted home directories (not created automatically for now).</div><div><br></div><div>I got almost everything working, but I seem to have a problem with kerberized nfs.</div><div><br></div><div>The NAS logs in the LDAP domain and seems happy with the kerberos principal that I uploaded.</div><div><br></div><div><br></div><div><br></div><div>* If I use plain nfs4 without krb5</div><div><br></div><div><div>- /etc/exports -</div></div><div>/volume1/shared_homes<span style="white-space:pre-wrap"> </span><a href="http://192.168.0.0/24(rw,async,no_wdelay,all_squash,insecure_locks,sec=sys,anonuid=1025,anongid=100)" target="_blank">192.168.0.0/24(rw,async,no_wdelay,all_squash,insecure_locks,sec=sys,anonuid=1025,anongid=100)</a><br></div><div><br></div><div>then I can mount it and use it (it even works with automount). But only using all_squash. Not useful:</div><div><br></div><div><br></div><div>* If I use krb5</div><div><br></div><div>- /etc/exports -</div><div>/volume1/shared_homes<span style="white-space:pre-wrap"> </span><a href="http://192.168.0.0/24(rw,async,no_wdelay,no_root_squash,insecure_locks,sec=krb5,anonuid=1025,anongid=100)" target="_blank">192.168.0.0/24(rw,async,no_wdelay,no_root_squash,insecure_locks,sec=krb5,anonuid=1025,anongid=100)</a><br></div><div><br></div><div>then I can kinit with an LDAP user, mount it with sec=krb5, but I get "nobody" as file owner.</div><div><br></div><div>This is done from a FC22 client, perfectly enrolled in freeIPA.</div><div><br></div><div>The client's log contains several of such errors:</div><div><br></div><div><div>gssproxy[807]: (OID: { 1 2 840 113554 1 2 2 }) Unspecified GSS failure. Minor code may provide more information, No credentials cache found</div><div><br></div></div><div><br></div><div>Any tip to help me understand what the problem is?</div><span class="HOEnZb"><font color="#888888"><div>Roberto</div></font></span></div> </blockquote></div><br></div>