2

Is it possible to set NFSv4 + Kerberos to do user-based authentication? As far as I understand you are required to create a principal for a client machine(i.e. it is still Host-based?) on Kerberos server, which requires admin access to KDC. In my case I have a working Kerberos environment where I can only get tickets for users, and have no admin access. So the question pretty much is - can I still somehow make NFSv4 use Kerberos authentication?

My NFSv4 server and Clients run CentOS 5, and I have no idea what is on the Kerberos side. My question might be unclear, I am still a newbie.

1 Answer 1

0

You can't run NFS without host credentials. Every time, then kernel interacts with the NFS server without direct user operation, machine credentials are used. Check man page for rpc.gssd, for example:

   When -n is specified, the kernel continues to  request  a  GSS  context
   established  with  a  machine  credential for NFSv4 operations, such as
   SETCLIENTID or RENEW, that manage state.  If rpc.gssd cannot  obtain  a
   machine  credential (say, the local system has no keytab), NFSv4 opera‐
   tions that require machine credentials will fail.
1
  • 1
    A user won't be able to mount their own directory from their laptop. This is shocking.
    – intelfx
    Oct 7, 2018 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .