Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a kerberized NFSv4 setup working well under Ubuntu for regular users, but I cannot get it working for root.

For most systems, I do not want to allow root access, but I have a couple servers where root access over NFS to this file server is mandatory.

I know that root on a given client uses the client's machine identity, rather than an ordinary kerberos principal.

What I can't figure out is: how can I equate a given machine identity with root access on the server? This seems possible under AIX and Solaris (with root= in the server's export file), but not linux.

I realize that I can allow "sys" authentication for only the hosts that need it and keep krb5 in place for all the others, but I would like to understand how to do it within the context of a fully kerberized environment.

Thanks,

nrb

P.S. I am using no_root_squash.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Well, here's a solution that works. It's not the only one, but it's the cleanest one in my opinion.

Provide a static mapping in the server's idmapd.conf file which equates the machine credentials of the client with the root account on the server.

You must also tell idmapd to check for static mappings first. The relevant snippet from my server config is:

[Translation]
GSS-Methods = static,nsswitch

[Static]
nfs/host.domain.com@DOMAIN.COM = root

As a note, the nfs client will go through the /etc/krb5.keytab looking for keys in (at least) the following order:

  • root/host.domain.com@DOMAIN.COM
  • nfs/host.domain.com@DOMAIN.COM
  • host/host.domain.com@DOMAIN.COM

It takes the first one and uses that. This is the name you must use in the Static section of the idmapd.conf file on the server.

nrb

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.