8

When running:

sudo mount -t nfs4 -o sec=krb5 sol.domain.com:/ /mnt

I get this error on the client:

mount.nfs4: access denied by server while mounting sol.domain.com:/

And on the server syslogs I read

UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for nfs/ip-#-#-#-#[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for nfs/ip-#-#-#-#[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database

Server keytab file:

ubuntu@sol:~$ sudo klist -e -k /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   7 host/[email protected] (aes256-cts-hmac-sha1-96) 
   7 host/[email protected] (arcfour-hmac) 
   7 host/[email protected] (des3-cbc-sha1) 
   7 host/[email protected] (des-cbc-crc) 
   9 nfs/[email protected] (aes256-cts-hmac-sha1-96) 
   9 nfs/[email protected] (arcfour-hmac) 
   9 nfs/[email protected] (des3-cbc-sha1) 
   9 nfs/[email protected] (des-cbc-crc)

Client keytab file:

ubuntu@mercury:~$ sudo klist -e -k /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 host/[email protected] (aes256-cts-hmac-sha1-96) 
   3 host/[email protected] (arcfour-hmac) 
   3 host/[email protected] (des3-cbc-sha1) 
   3 host/[email protected] (des-cbc-crc) 
   3 nfs/[email protected] (aes256-cts-hmac-sha1-96) 
   3 nfs/[email protected] (arcfour-hmac) 
   3 nfs/[email protected] (des3-cbc-sha1) 
   3 nfs/[email protected] (des-cbc-crc)
8
  • please share your /etc/krb5.conf and /var/kerberos/krb5kdc/kdc.conf files from your server and client.
    – cikuraku
    Apr 8, 2012 at 9:29
  • @cikuraku I'm just using the default Ubuntu ones with the exception of adding allow_weak_crypto = true to the end. Apr 9, 2012 at 17:22
  • Does the ip address for mercury.domain.com reverse to the correct hostname? Does mercury.domain.com have more than one address configured on its interfaces?
    – larsks
    Apr 21, 2012 at 0:35
  • Also...are any clients successfully mounting shares from this server? Or is this your only client?
    – larsks
    Apr 21, 2012 at 0:36
  • No clients are connecting. Apr 21, 2012 at 17:34

1 Answer 1

1

It seems that the reverse name resolution for the IP is not matching the name you are expecting. Make sure that mercury.domain.com and sol.domain.com are the first name that you added to /etc/hosts after the relevant IP address. To be safe, just add a couple of lines on the top with the IP address of the machine and the hostname that kerberos expects.

10.x.y.z sol.domain.com sol ip-blah-blah
10.a.b.c mercury.domain.com mercury ip-other-other

Make sure that both of these lines are present on both the client and the server.

It is also a good idea verify the setup by running the following command on both the client and the server. Make sure that the first hostname printed for each IP address is the one you are expecting.

getent hosts 10.x.y.z 10.a.b.c

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .