<div dir="ltr">Hi All,<div><br></div><div>Kerberised NFS works well with gssproxy for IPA users, but I'm unable to map root user like I was with rpcsvcgssd. I understand gssproxy does not use idmapd anymore, and the mapping has to be done in krb5 directly (/etc/krb5.conf and/or ~/.k5login). It doesn't appear to work - any pointers would be very welcome.</div><div><br></div><div><div style="font-size:12.8px">My env:</div><div style="font-size:12.8px"><br></div><div><div style="font-size:12.8px"><font face="monospace, monospace">$ lsb_release -d</font></div><div style="font-size:12.8px"><font face="monospace, monospace">Description: Red Hat Enterprise Linux Server release 7.3 (Maipo)</font></div><div><font face="monospace, monospace" style="font-size:12.8px">$ rpm -q </font><font face="monospace, monospace"><span style="font-size:12.8px">ipa-client gssproxy</span></font></div><div style="font-size:12.8px"><span style="font-size:12.8px;font-family:monospace,monospace">ipa-client-4.4.0-14.el7_3.4.x86_64</span><br></div><div style="font-size:12.8px"><font face="monospace, monospace"><div style="font-size:12.8px">gssproxy-0.4.1-13.el7.x86_64</div></font></div><div style="font-size:12.8px"><font face="monospace, monospace">$ ipa --version</font></div><div style="font-size:12.8px"><font face="monospace, monospace">VERSION: 4.4.0, API_VERSION: 2.213</font></div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Kerberised NFS works fine for users that exist in IPA, so I won't cover that part of the config and focus on the root mapping.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">On the "nfsserver" machine, /etc/krb5.conf is this:</div><div style="font-size:12.8px"><br></div><div><div><span style="font-size:12.8px"><font face="monospace, monospace">includedir /var/lib/sss/pubconf/krb5.include.d/</font></span></div><div><span style="font-family:monospace,monospace;font-size:12.8px">[libdefaults]</span><br></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> default_realm = <a href="http://DOM.COM">DOM.COM</a></font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> dns_lookup_realm = true</font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> dns_lookup_kdc = true</font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> rdns = false</font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> ticket_lifetime = 24h</font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> forwardable = yes</font></span></div><div><span style="font-family:monospace,monospace;font-size:12.8px"> default_ccache_name = KEYRING:persistent:%{uid}</span><br></div><div><span style="font-family:monospace,monospace;font-size:12.8px">[realms]</span><br></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> <a href="http://DOM.COM">DOM.COM</a> = {</font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> pkinit_anchors = FILE:/etc/ipa/ca.crt</font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> kdc = <a href="http://ipaserver.dom.com:88">ipaserver.dom.com:88</a></font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> master_kdc = <a href="http://ipaserver.dom.com:88">ipaserver.dom.com:88</a></font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> admin_server = <a href="http://ipaserver.dom.com:749">ipaserver.dom.com:749</a></font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> default_domain = <a href="http://dom.com">dom.com</a></font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> auth_to_local = RULE:[2:$1/$2@$0](nfs/<a href="mailto:nfsclient.dom.com@DOM.COM">nfsclient.dom.com@DOM.COM</a>)s/^.*$/root/g</font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> auth_to_local = RULE:[2:$1/$2@$0](host/<a href="mailto:nfsclient.dom.com@DOM.COM">nfsclient.dom.com@DOM.COM</a>)s/^.*$/root/g</font></span></div><div><span style="font-family:monospace,monospace;font-size:12.8px"> auto_to_local = DEFAULT</span><br></div><div><font face="monospace, monospace"><span style="font-size:12.8px"> }</span><br></font></div><div><font face="monospace, monospace"><span style="font-size:12.8px">[domain_realm]</span><br></font></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> .<a href="http://dom.com">dom.com</a> = <a href="http://DOM.COM">DOM.COM</a></font></span></div><div><span style="font-size:12.8px"><font face="monospace, monospace"> <a href="http://dom.com">dom.com</a> = <a href="http://DOM.COM">DOM.COM</a></font></span></div></div><div><br></div><div>And the contents of "/var/lib/sss/pubconf/krb5.include.d/localauth_plugin" are:</div><div><br></div><div><div><font face="monospace, monospace">[plugins]<br></font></div><div><font face="monospace, monospace"> localauth = {</font></div><div><font face="monospace, monospace"> module = sssd:/usr/lib64/sssd/modules/sssd_krb5_localauth_plugin.so</font></div><div><font face="monospace, monospace"> }</font></div></div><div><br></div><div>I understand that does NOT mean default, rule, auth_to_local and k5login are disabled for "localauth", they're enabled by default transparently to my reading of krb5.conf man page (and I also confirmed k5login as working with SSH).</div><div><br></div><div>Contents of /root/.k5login also on "nfsserver" machine:</div><div><br></div><div><div><font face="monospace, monospace">host/<a href="mailto:nfsclient.dom.com@DOM.COM">nfsclient.dom.com@DOM.COM</a><br></font></div><div><font face="monospace, monospace">nfs/<a href="mailto:nfsclient.dom.com@DOM.COM">nfsclient.dom.com@DOM.COM</a></font></div><div><br></div></div><div>While in possession of a ticket for either of the 2 principals above, on "nfsclient" machine as root user, I can SSH password-less (and SSH-keyless of course) root to root, to "nfsserver". I can no longer SSH if I don't have either "host/..." or "nfs/..." principal on the "nfsclient". So that confirms k5login works correctly I suppose.</div><div><br></div><div>Also shortly after mounting an NFS share on the "nfsclient" machine, I see this in NFS ID translations (not sure how to read it exactly):</div><div><br></div><div><font face="monospace, monospace">$ cat /proc/net/rpc/nfs4.idtoname/content<br></font></div><div><div><font face="monospace, monospace">gss/krb5i user 0 host/<a href="mailto:nfsclient.dom.com@DOM.COM">nfsclient.dom.com@DOM.COM</a><br></font></div><div><font face="monospace, monospace">gss/krb5i group 0 host/<a href="mailto:nfsclient.dom.com@DOM.COM">nfsclient.dom.com@DOM.COM</a></font></div></div><div><br></div><div>And yet the directory that is mounted is seen as "nobody:nobody" by root on "nfsclient", and I can't seem to be able to convince gssproxy/nfs to map it to root on the client.</div><div><br></div><div>My /etc/exports on "nfsserver":</div><div><br></div><div><font face="monospace, monospace">/exports/backup <a href="http://10.11.5.0/24(rw,sec=krb5:krb5i:krb5p,no_subtree_check,no_root_squash)">10.11.5.0/24(rw,sec=krb5:krb5i:krb5p,no_subtree_check,no_root_squash)</a></font><br></div><div><br></div><div>I also keep my "old" /etc/idmapd.conf around on "nfsserver" machine and keep idmapd running, even though in theory this is no longer used. This is its contents (and what used to work for me mapping root to root via rpcsvcgssd):</div><div><br></div><div><div><font face="monospace, monospace">[General]</font></div><div><font face="monospace, monospace">Domain = <a href="http://dom.com">dom.com</a></font></div><div><font face="monospace, monospace">[Mapping]</font></div><div><font face="monospace, monospace">Nobody-User = nobody</font></div><div><font face="monospace, monospace">Nobody-Group = nobody</font></div><div><font face="monospace, monospace">[Translation]</font></div><div><font face="monospace, monospace">Method = static,sss</font></div><div><font face="monospace, monospace">[Static]<br></font></div><div><font face="monospace, monospace">host/<a href="mailto:nfsclient.dom.com@DOM.COM">nfsclient.dom.com@DOM.COM</a> = root</font></div><div><font face="monospace, monospace">nfs/<a href="mailto:nfsclient.dom.com@DOM.COM">nfsclient.dom.com@DOM.COM</a> = root</font></div></div><div><br></div><div><br></div><div>What have I missed / what else needs to be set up where to allow gssproxy and kerberised NFS backed by IPA to map root on NFS client?</div><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr">Thanks,<div><br></div><div>Greg Kubok.</div></div></div> </div></div>