<html><head/><body><html><head></head><body>Your syntax seem correct but you need to quote the value.<br><br><div class="gmail_quote">Natxo Asenjo <natxo.asenjo@gmail.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr"><div><div><div><div><div><div><div><div><div>hi,<br /><br /></div>apparently what I am trying to do is not very usual because I do not get any answer on the omnios (opensolaris derivative) mailing list.<br /><br /></div>
I have successfully joined a host to the ipa domain, I can log in the omnios host as an ipa user, getent works, kerberos works (thanks to Johan Petersson in this thread: <a href="https://www.redhat.com/archives/freeipa-users/2013-January/msg00021.html">https://www.redhat.com/archives/freeipa-users/2013-January/msg00021.html</a>) <br />
<br /></div>But when configuring nfs with krb5(i/p) security I get an error:<br /><br /># zfs set sharenfs=sec=krb5 rpool/export/home<br />cannot set property for 'rpool/export/home': 'sharenfs' cannot be set to invalid options<br />
<br /># share -F nfs -o sec=krb5 -d "homedirs" /export/home/<div class="im">Could not share: /export/home: invalid security type</div><br /></div>The omnios host has a keytab with both host and nfs principals:<br /><br />
# klist -k -e<div class="im"><br />Keytab name: FILE:/etc/krb5/krb5.keytab<br />KVNO Principal<br />---- --------------------------------------------------------------------------<br /></div>
1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (AES-256 CTS mode with 96-bit SHA-1 HMAC) <br /> 1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (AES-128 CTS mode with 96-bit SHA-1 HMAC) <br /> 1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (Triple DES cbc mode with HMAC/sha1) <br />
1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (ArcFour with HMAC/md5) <br /> 2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (AES-256 CTS mode with 96-bit SHA-1 HMAC) <br /> 2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (AES-128 CTS mode with 96-bit SHA-1 HMAC) <br />
2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (Triple DES cbc mode with HMAC/sha1) <br /> 2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (ArcFour with HMAC/md5)<br /><br /></div>I can kinit with both principals:<br /><br />root@testomnios:~# kinit -k<br />
root@testomnios:~# klist <br />Ticket cache: FILE:/tmp/krb5cc_0<br />Default principal: host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br /><br />Valid starting Expires Service principal<br />
04/12/13 11:56:07 04/13/13 11:56:07 krbtgt/IPA.ASENJO.NX@IPA.ASENJO.NX<br /> renew until 04/19/13 11:56:07<br />root@testomnios:~# kinit -k nfs/testomnios.ipa.asenjo.nx<br />root@testomnios:~# klist<br />Ticket cache: FILE:/tmp/krb5cc_0<br />
Default principal: nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br /><br />Valid starting Expires Service principal<br />04/12/13 11:56:28 04/13/13 11:56:28 krbtgt/IPA.ASENJO.NX@IPA.ASENJO.NX<br /> renew until 04/19/13 11:56:28<br />
<br /></div>so the keytab is correct<br /><br /></div>I have edited /etc/nfssec.conf and removed the comments for the krb5 lines.<br /><br /></div>According to all my google-fu it should work, but it does not. Any tips greatly appreciated.<br />
. <br /></div><div><div><div><div><div><div><div><div><div><div><div>--<br />Groeten,<br />natxo</div>
</div></div></div></div></div></div></div></div></div></div></div>
<p style="margin-top: 2.5em; margin-bottom: 1em; border-bottom: 1px solid #000"></p><pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif; margin-top: 0px"><hr /><br />Freeipa-users mailing list<br />Freeipa-users@redhat.com<br /><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre></blockquote></div><br>
-- <br>
Sent from my Android phone with K-9 Mail. Please excuse my brevity.</body></html></body></html>