<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"><base href="x-msg://10779/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jul 12, 2013, at 2:43 PM, Ondrej Valousek <<a href="mailto:ovalousek@vendavo.com">ovalousek@vendavo.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-family: monospace; font-size: 10pt; "><div>Just back to the Kerberized NFS. Any solution to RH bugzilla #786463 on the horizon yet?</div><div>Expiring tickets will render the whole concept unusable otherwise.</div><div><br></div><div>Anyone?</div></div></blockquote><div><br></div><div>Ask on <a href="mailto:linux-nfs@vger.kernel.org">linux-nfs@vger.kernel.org</a>. I know upstream is working on this problem.</div><br><blockquote type="cite"><div style="font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-family: monospace; font-size: 10pt; "><div>O.</div><div><br></div><div><br></div><div><div style="font-size: 10px; color: rgb(87, 87, 87); ">Odesláno ze Samsung Mobile</div></div><br><br><br>-------- Původní zpráva --------<br>Od: Ondrej Valousek <<a href="mailto:ovalousek@vendavo.com">ovalousek@vendavo.com</a>><span class="Apple-converted-space"> </span><br>Datum:<span class="Apple-converted-space"> </span><br>Komu:<span class="Apple-converted-space"> </span><a href="mailto:andrew@wasielewski.co.uk">andrew@wasielewski.co.uk</a>,<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><span class="Apple-converted-space"> </span><br>Předmět: RE: [Freeipa-users] Problem with Kerberised NFS mount<span class="Apple-converted-space"> </span><br><br><br><div><div>Hard to say.</div><div>In general, when dealing w/ nfs & kerberos, I would advise to:</div><div>● Upgrade to the latest fedora</div><div>● Make sure idmapper is configured and working fine</div><div>● Limit krb enctypes to 3des-cbc-crc (not sure if your kernel can handle aes keys).</div><div>Ondrej</div><div><br></div><div><br></div><div><div style="font-size: 10px; color: rgb(87, 87, 87); ">Odesláno ze Samsung Mobile</div></div><br><br><br>-------- Původní zpráva --------<br>Od: Andrew Wasielewski <<a href="mailto:andrew@wasielewski.co.uk">andrew@wasielewski.co.uk</a>><span class="Apple-converted-space"> </span><br>Datum:<span class="Apple-converted-space"> </span><br>Komu:<span class="Apple-converted-space"> </span><a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><span class="Apple-converted-space"> </span><br>Předmět: [Freeipa-users] Problem with Kerberised NFS mount<span class="Apple-converted-space"> </span><br><br><br><div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Hello everyone,</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
I am setting up FreeIPA for a small home network. However I have a problem mounting NFS shares with Kerberos enables - see syslog output below.</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
My NFS, KDC and FreeIPA servers are all on the same host. I am running the NFS mount directly on the server, which has local firewall disabled - I get the same outcome on a remote client, but this surely eliminates any network issues.</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
These are my NFS exports, which are visible both locally and remotely with "showmount -e":-</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
[root@server ~]# exportfs -av</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
exporting gss/krb5:/home</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
exporting gss/krb5i:/home</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
exporting gss/krb5p:/home</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
The command "mount -t nfs4 -o sec=krb5 <a href="http://server.wasielewski.co.uk">server.wasielewski.co.uk</a>:/home /mnt/test_mnt" hangs indefinitely. However without the Kerberos export options the NFS share can be mounted both locally and remotely without problem.</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
I read in a post that the "serializing key with enctype 18 and size 32" entry in syslog means I am trying to use an unsupported key with AES256 encryption (I can find very little about enctype numbers though); however I appear to have an AES256 service principal:</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
[root@server etc]# ktutil</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
ktutil: rkt /etc/krb5.keytab</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
ktutil: list -e</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
slot KVNO Principal</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
---- ---- ---------------------------------------------------------------------</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
1 2 <a href="mailto:host/server.wasielewski.co.uk@WASIELEWSKI.CO.UK">host/server.wasielewski.co.uk@WASIELEWSKI.CO.UK</a> (aes256-cts-hmac-sha1-96) </div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
2 2 <a href="mailto:host/server.wasielewski.co.uk@WASIELEWSKI.CO.UK">host/server.wasielewski.co.uk@WASIELEWSKI.CO.UK</a> (aes128-cts-hmac-sha1-96) </div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
3 2 <a href="mailto:host/server.wasielewski.co.uk@WASIELEWSKI.CO.UK">host/server.wasielewski.co.uk@WASIELEWSKI.CO.UK</a> (des3-cbc-sha1) </div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
4 2 <a href="mailto:host/server.wasielewski.co.uk@WASIELEWSKI.CO.UK">host/server.wasielewski.co.uk@WASIELEWSKI.CO.UK</a> (arcfour-hmac) </div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
5 5 <a href="mailto:nfs/server.wasielewski.co.uk@WASIELEWSKI.CO.UK">nfs/server.wasielewski.co.uk@WASIELEWSKI.CO.UK</a> (aes256-cts-hmac-sha1-96) </div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
My versions are:</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Fedora 17 (kernel 3.8.13-100.fc17.x86_64)</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
FreeIPA 2.2.2</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
krb5 1.10.2</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
nfs-utils 1.2.6</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
I have read of this issue being fixed by downgrading nfs-utils to 1.2.5; however that is not possible due to conflict with systemd. Everything else appears to work OK e.g. domain login, automap etc. When I try to mount the Kerberised NFS share, *nothing* appears
in /var/log/krb5kdc.log</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Here is my syslog output when attempt the mount:</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: dir_notify_handler: sig 37 si 0x7fffe59b94f0 data 0x7fffe59b93c0</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: handling gssd upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt48)</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 '</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: handling krb5 upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt48)</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: process_krb5_upcall: service is '<null>'</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: Full hostname for '<a href="http://server.wasielewski.co.uk">server.wasielewski.co.uk</a>' is '<a href="http://server.wasielewski.co.uk">server.wasielewski.co.uk</a>'</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: Full hostname for '<a href="http://server.wasielewski.co.uk">server.wasielewski.co.uk</a>' is '<a href="http://server.wasielewski.co.uk">server.wasielewski.co.uk</a>'</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: No key table entry found for <a href="mailto:SERVER.WASIELEWSKI.CO.UK$@WASIELEWSKI.CO.UK">SERVER.WASIELEWSKI.CO.UK$@WASIELEWSKI.CO.UK</a> while getting keytab entry for '<a href="mailto:SERVER.WASIELEWSKI.CO.UK$@WASIELEWSKI.CO.UK">SERVER.WASIELEWSKI.CO.UK$@WASIELEWSKI.CO.UK</a>'</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: No key table entry found for <a href="mailto:root/server.wasielewski.co.uk@WASIELEWSKI.CO.UK">root/server.wasielewski.co.uk@WASIELEWSKI.CO.UK</a> while getting keytab entry for '<a href="mailto:root/server.wasielewski.co.uk@WASIELEWSKI.CO.UK">root/server.wasielewski.co.uk@WASIELEWSKI.CO.UK</a>'</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: Success getting keytab entry for '<a href="mailto:nfs/server.wasielewski.co.uk@WASIELEWSKI.CO.UK">nfs/server.wasielewski.co.uk@WASIELEWSKI.CO.UK</a>'</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_WASIELEWSKI.CO.UK' are good until 1373659035</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_WASIELEWSKI.CO.UK' are good until 1373659035</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: using FILE:/tmp/krb5cc_machine_WASIELEWSKI.CO.UK as credentials cache for machine creds</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: using environment variable to select krb5 ccache FILE:/tmp/krb5cc_machine_WASIELEWSKI.CO.UK</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: creating context using fsuid 0 (save_uid 0)</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: creating tcp client for server <a href="http://server.wasielewski.co.uk">server.wasielewski.co.uk</a></div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: DEBUG: port already set to 2049</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: creating context with server <a href="mailto:nfs@server.wasielewski.co.uk">nfs@server.wasielewski.co.uk</a></div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: leaving poll</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: handling null request</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: svcgssd_limit_krb5_enctypes: Calling gss_set_allowable_enctypes with 7 enctypes from the kernel</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: sname = <a href="mailto:nfs/server.wasielewski.co.uk@WASIELEWSKI.CO.UK">nfs/server.wasielewski.co.uk@WASIELEWSKI.CO.UK</a></div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: DEBUG: serialize_krb5_ctx: lucid version!</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: prepare_krb5_rfc4121_buffer: protocol 1</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: doing downcall</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: mech: krb5, hndl len: 4, ctx len 52, timeout: 1373659035 (71045 from now), clnt: <a href="mailto:nfs@server.wasielewski.co.uk">nfs@server.wasielewski.co.uk</a>, uid: -1, gid: -1, num aux grps: 0:</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: sending null reply</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: writing message: \x \x6082029f06092a864886f71201020201006e82028e3082028aa003020105a10302010ea20703050020000000a3820184618201803082017ca003020105a1131b1157415349454c4557534b492e434f2e554ba22a3028a003020103a121301f1b036e66731b187365727665722e77617369656c6577736b692e636f2e756ba38201323082012ea003020112a103020105a28201200482011ccd1627a49a2911b9662144c0c43f9e64d78f4e817846f95884f3f43ea053b3954f22fb2d287d9ad0e24f88e32301d6a6f3f70d0e415b9c957e60e773b45b3a065258f1614451a258e3ce05f5c1fb889882b336223a32db10bea70dd334f22b9e1efaddd8b417994f6168d42a065e160353243de8aa53b4449a477567673212d68c241975300d12be7a756b7d4c7c75f8e5e82d84223ad592f6fec6897baa79b92e7097ecf1237f6c2c8ac2555c7c60782f51c386782eb56147e1ffcc8c4de94fba31d1e7a20f88b2ce88a9eb8059a9fe5731c22075280ec9eaf01fc81fccac841002f65d86e0b7000074b84661cb9ceed5e77ca4bdadfbe345ea41467392441ca5f202db006e019826d81d60e383427b5cd766f23b15b4e4eb8ebc1ba481ec3081e9a003020112a281e10481de69f0cdd8b94ef7123715131198824fa3c953d25f7dfea3b253df9623e44c660e7a96629eb323e5616bd7162e0ba4ec2d6037e3b3409be10410b2d3ffc0e2b1631b5dac718c3dfde170ec050bfc1dde657fcb7f35a7ef38e20477fea9d5f7e1320a77eef539455383080522686d1fbfb7bef8cb200dc8810c56e68bc25ad011aff3397781713aa8b696ec9f94843822449d1930b96530f69203840eab8d8398faf1286fde6edf7ef315489aa6621e1be8ea8375c52084895498f57183ccd0a104e7ac244a3fab12449144499a2308103e432c47d945f80e644f4df17271c0
1373588050 0 0 \x73000000 \x60819906092a864886f71201020202006f8189308186a003020105a10302010fa27a3078a003020112a271046f87a21e99d0907eadcd179fef73a8a4b38cb8180566d1f2cea453e28b7334b0648a543c3f2588a79f516f7d2238e1cca4ca5ec290b2a5d8b9d570ba47fdc20a2d36bc54928c3addba9b68867028c9adb157e487cc0951bc1270f9f1b96e643bb614589411cc923a9fbe5654beb20d85</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: finished handling null request</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.svcgssd[32135]: entering poll</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: DEBUG: serialize_krb5_ctx: lucid version!</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: prepare_krb5_rfc4121_buffer: protocol 1</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32</div><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Jul 12 01:13:10 server rpc.gssd[31628]: doing downcall</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Any advice is much appreciated.</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><div style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
Andrew</div><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p><p style="white-space: pre-wrap; margin: 0px; text-indent: 0px; ">
</p></div></div>_______________________________________________<br>Freeipa-users mailing list<br><a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></div></blockquote></div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; ">-- <br>Chuck Lever<br>chuck[dot]lever[at]oracle[dot]com<br><br><br><br></span>
</div>
<br></body></html>