Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have the following nfs export:

/home/users     192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534)

When trying to mount that on a client I get:

client:/home # mount -t nfs4 -o sec=krb5p server:/home/users /home/users -vvv
mount.nfs4: timeout set for Sun May 12 21:13:56 2013
mount.nfs4: trying text-based options 'sec=krb5p,addr=192.168.1.2,clientaddr=192.168.1.62'
mount.nfs4: mount(2): Permission denied
mount.nfs4: access denied by server while mounting server:/home/users

On the server syslog I get:

May 12 19:59:48 server krb5kdc[2704]: AS_REQ (4 etypes {18 17 16 23}) 192.168.1.62: NEEDED_PREAUTH: nfs/client.localdomain@REALM for krbtgt/REALM@REALM, Additional pre-authentication required
May 12 19:59:48 server krb5kdc[2704]: preauth (encrypted_timestamp) verify failure: Decrypt integrity check failed
May 12 19:59:48 server krb5kdc[2704]: AS_REQ (4 etypes {18 17 16 23}) 192.168.1.62: PREAUTH_FAILED: nfs/client.localdomain@REALM for krbtgt/REALM@REALM, Decrypt integrity check failed

As far as I can tell the keytabs have been set correctly:

client:

client:/home # ktutil 
ktutil:  rkt /etc/krb5.keytab 
ktutil:  list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    4                        nfs/client.localdomain@REALM
   2    4                        nfs/client.localdomain@REALM
   3    4                        nfs/client.localdomain@REALM
   4    4                        nfs/client.localdomain@REALM
   5    4                       host/client.localdomain@REALM
   6    4                       host/client.localdomain@REALM
   7    4                       host/client.localdomain@REALM
   8    4                       host/client.localdomain@REALM

Server:

root@server:~# ktutil 
ktutil:  rkt /etc/krb5.keytab 
ktutil:  list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    3                     host/server.localdomain@REALM
   2    3                     host/server.localdomain@REALM
   3    3                     host/server.localdomain@REALM
   4    3                     host/server.localdomain@REALM
   5    2                     cifs/server.localdomain@REALM
   6    2                   HTTP/server.localdomain@REALM
   7    2                   HTTP/server.localdomain@REALM
   8    2                   HTTP/server.localdomain@REALM
   9    2                   HTTP/server.localdomain@REALM
  10    2                      nfs/server.localdomain@REALM
  11    2                      nfs/server.localdomain@REALM
  12    2                      nfs/server.localdomain@REALM
  13    2                      nfs/server.localdomain@REALM

Kerberos user authentication with kinit on the client works fine.

When I attempt the same nfs mount on server itself, it succeeds.

What is pre-authentication and what are the possible causes for the pre-authentication to fail?

share|improve this question
    
Oh Kerberos, you so cray. –  Tom O'Connor May 12 '13 at 20:27

1 Answer 1

Turns out that regenerating the client keytab fixed the problem somehow.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.