Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm configuring NFS4 over Heimdal. After two days configuring this stuff, I've got to a point that all principals are found, everything is present in the keytab, but it still fails and I don't have a clue why.

$ kdestroy; sudo mount /mnt/nfs/nfshome/home

This is the definition of the file system in /etc/fstab:

nfshome.localdomain:/home  /mnt/nfs/nfshome/home  nfs4  noauto,rw,bg,soft,sec=krb5  0  0

The relevant log is:

Sep 12 03:28:56 apps rpc.gssd[9366]: Success getting keytab entry for 'APPS$@LOCALDOMAIN'
Sep 12 03:28:57 apps rpc.gssd[9366]: WARNING: Generic preauthentication failure while getting initial ticket for principal 'APPS$@LOCALDOMAIN' using keytab 'FILE:/etc/krb5.keytab'
Sep 12 03:28:57 apps rpc.gssd[9366]: ERROR: No credentials found for connection to server nfshome.localdomain

Please find the full log below. Observe that even the strange principal APPS$@LOCALDOMAIN was created and inserted in the keytab.

Sep 12 03:28:56 apps rpc.gssd[9366]: dir_notify_handler: sig 37 si 0x7fff8d2f2bf0 data 0x7fff8d2f2ac0
Sep 12 03:28:56 apps rpc.gssd[9366]: dir_notify_handler: sig 37 si 0x7fff8d2f2bf0 data 0x7fff8d2f2ac0
Sep 12 03:28:56 apps rpc.gssd[9366]: dir_notify_handler: sig 37 si 0x7fff8d2f2bf0 data 0x7fff8d2f2ac0
Sep 12 03:28:56 apps rpc.gssd[9366]: handling gssd upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt20)
Sep 12 03:28:56 apps rpc.gssd[9366]: handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 '
Sep 12 03:28:56 apps rpc.gssd[9366]: handling krb5 upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt20)
Sep 12 03:28:56 apps rpc.gssd[9366]: process_krb5_upcall: service is '<null>'
Sep 12 03:28:56 apps rpc.gssd[9366]: Full hostname for 'nfshome.localdomain' is 'nfshome.localdomain'
Sep 12 03:28:56 apps rpc.gssd[9366]: Full hostname for 'apps' is 'apps'
Sep 12 03:28:56 apps rpc.gssd[9366]: Success getting keytab entry for 'APPS$@LOCALDOMAIN'
Sep 12 03:28:57 apps rpc.gssd[9366]: WARNING: Generic preauthentication failure while getting initial ticket for principal 'APPS$@LOCALDOMAIN' using keytab 'FILE:/etc/krb5.keytab'
Sep 12 03:28:57 apps rpc.gssd[9366]: ERROR: No credentials found for connection to server nfshome.localdomain
Sep 12 03:28:57 apps rpc.gssd[9366]: doing error downcall
Sep 12 03:28:57 apps rpc.gssd[9366]: dir_notify_handler: sig 37 si 0x7fff8d2f2bf0 data 0x7fff8d2f2ac0
Sep 12 03:28:57 apps rpc.gssd[9366]: dir_notify_handler: sig 37 si 0x7fff8d2f2bf0 data 0x7fff8d2f2ac0
Sep 12 03:28:57 apps rpc.gssd[9366]: dir_notify_handler: sig 37 si 0x7fff8d2f2bf0 data 0x7fff8d2f2ac0
Sep 12 03:28:57 apps rpc.gssd[9366]: dir_notify_handler: sig 37 si 0x7fff8d2f2bf0 data 0x7fff8d2f2ac0
Sep 12 03:28:57 apps rpc.gssd[9366]: dir_notify_handler: sig 37 si 0x7fff8d2f2bf0 data 0x7fff8d2f2ac0
Sep 12 03:28:57 apps rpc.gssd[9366]: dir_notify_handler: sig 37 si 0x7fff8d2f2bf0 data 0x7fff8d2f2ac0
Sep 12 03:28:57 apps rpc.gssd[9366]: dir_notify_handler: sig 37 si 0x7fff8d2f2bf0 data 0x7fff8d2f2ac0
Sep 12 03:28:57 apps rpc.gssd[9366]: destroying client /var/lib/nfs/rpc_pipefs/nfs/clnt21
Sep 12 03:28:57 apps rpc.gssd[9366]: destroying client /var/lib/nfs/rpc_pipefs/nfs/clnt20

I've also had a look on the KDC logs and I found this below, which apparently appears when principal APPS$@LOCALDOMAIN is retrieved:

2013-09-12T11:14:47 AS-REQ APPS$@LOCALDOMAIN from IPv4:192.168.122.100 for krbtgt/LOCALDOMAIN@LOCALDOMAIN
2013-09-12T11:14:47 Client sent patypes: REQ-ENC-PA-REP
2013-09-12T11:14:47 Looking for PK-INIT(ietf) pa-data -- APPS$@LOCALDOMAIN
2013-09-12T11:14:47 Looking for PK-INIT(win2k) pa-data -- APPS$@LOCALDOMAIN
2013-09-12T11:14:47 Looking for ENC-TS pa-data -- APPS$@LOCALDOMAIN
2013-09-12T11:14:47 Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ
2013-09-12T11:14:47 sending 269 bytes to IPv4:192.168.122.100

So, there are two issues:

(1) There's a WARNING message which complains about principal APPS$@LOCALDOMAIN, that was successfully found. It's not clear to me why.

(2) The ERROR message complains about host nfshome.localdomain, but I've created all sorts of principals for it I can imagine. Please find below:

rgomes@apps:~/scripts/sysadmin$ sudo ktutil list | fgrep -i nfshome
  1  aes256-cts-hmac-sha1-96  NFSHOME$@LOCALDOMAIN                             
  1  des3-cbc-sha1            NFSHOME$@LOCALDOMAIN                             
  1  arcfour-hmac-md5         NFSHOME$@LOCALDOMAIN                             
  1  aes256-cts-hmac-sha1-96  nfs/nfshome@LOCALDOMAIN                          
  1  des3-cbc-sha1            nfs/nfshome@LOCALDOMAIN                          
  1  arcfour-hmac-md5         nfs/nfshome@LOCALDOMAIN                          
  1  aes256-cts-hmac-sha1-96  host/nfshome@LOCALDOMAIN                         
  1  des3-cbc-sha1            host/nfshome@LOCALDOMAIN                         
  1  arcfour-hmac-md5         host/nfshome@LOCALDOMAIN                         
  1  aes256-cts-hmac-sha1-96  root/nfshome@LOCALDOMAIN                         
  1  des3-cbc-sha1            root/nfshome@LOCALDOMAIN                         
  1  arcfour-hmac-md5         root/nfshome@LOCALDOMAIN                         
  1  aes256-cts-hmac-sha1-96  nfs/nfshome.localdomain@LOCALDOMAIN              
  1  des3-cbc-sha1            nfs/nfshome.localdomain@LOCALDOMAIN              
  1  arcfour-hmac-md5         nfs/nfshome.localdomain@LOCALDOMAIN              
  1  aes256-cts-hmac-sha1-96  host/nfshome.localdomain@LOCALDOMAIN             
  1  des3-cbc-sha1            host/nfshome.localdomain@LOCALDOMAIN             
  1  arcfour-hmac-md5         host/nfshome.localdomain@LOCALDOMAIN             
  1  aes256-cts-hmac-sha1-96  root/nfshome.localdomain@LOCALDOMAIN             
  1  des3-cbc-sha1            root/nfshome.localdomain@LOCALDOMAIN             
  1  arcfour-hmac-md5         root/nfshome.localdomain@LOCALDOMAIN   

More information about my environment:

rgomes@apps:~/scripts/sysadmin$ cat /etc/debian_version 
7.1
rgomes@apps:~/scripts/sysadmin$ 
rgomes@apps:~/scripts/sysadmin$ uname -a
Linux apps 3.2.0-4-amd64 #1 SMP Debian 3.2.46-1+deb7u1 x86_64 GNU/Linux
rgomes@apps:~/scripts/sysadmin$ 
rgomes@apps:~/scripts/sysadmin$ dpkg --list | fgrep krb5
ii  krb5-config                        2.3                           all          Configuration files for Kerberos Version 5
ii  krb5-locales                       1.10.1+dfsg-5+deb7u1          all          Internationalization support for MIT Kerberos
ii  krb5-multidev                      1.10.1+dfsg-5+deb7u1          amd64        Development files for MIT Kerberos without Heimdal conflict
ii  libgssapi-krb5-2:amd64             1.10.1+dfsg-5+deb7u1          amd64        MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
ii  libkrb5-26-heimdal:amd64           1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - libraries
ii  libkrb5-3:amd64                    1.10.1+dfsg-5+deb7u1          amd64        MIT Kerberos runtime libraries
ii  libkrb5-dev                        1.10.1+dfsg-5+deb7u1          amd64        Headers and development libraries for MIT Kerberos
ii  libkrb5support0:amd64              1.10.1+dfsg-5+deb7u1          amd64        MIT Kerberos runtime libraries - Support library
ii  libpam-krb5:amd64                  4.6-1                         amd64        PAM module for MIT Kerberos
rgomes@apps:~/scripts/sysadmin$ 
rgomes@apps:~/scripts/sysadmin$ dpkg --list | fgrep heimdal
ii  heimdal-clients                    1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - clients
ii  heimdal-docs                       1.6~git20120403+dfsg1-2       all          Heimdal Kerberos - documentation
iF  heimdal-kcm                        1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - KCM daemon
ii  libasn1-8-heimdal:amd64            1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - ASN.1 library
ii  libgssapi3-heimdal:amd64           1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - GSSAPI support library
ii  libhcrypto4-heimdal:amd64          1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - crypto library
ii  libhdb9-heimdal:amd64              1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - kadmin server library
ii  libheimbase1-heimdal:amd64         1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - Base library
ii  libheimntlm0-heimdal:amd64         1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - NTLM support library
ii  libhx509-5-heimdal:amd64           1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - X509 support library
ii  libkadm5clnt7-heimdal:amd64        1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - kadmin client library
ii  libkadm5srv8-heimdal:amd64         1.6~git20120403+dfsg1-2       amd64        Libraries for Heimdal Kerberos
ii  libkafs0-heimdal:amd64             1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - KAFS support library
ii  libkrb5-26-heimdal:amd64           1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - libraries
ii  libotp0-heimdal:amd64              1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - OTP support library
ii  libroken18-heimdal:amd64           1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - roken support library
ii  libsl0-heimdal:amd64               1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - SL support library
ii  libwind0-heimdal:amd64             1.6~git20120403+dfsg1-2       amd64        Heimdal Kerberos - stringprep implementation

In addition, I inform that I generated /etc/krb5.keytab from scratch on all boxes involved (KDC master, KDC slave, NFS server, NFS client) using this script:

function create_keytab() {
  sudo rm -r -f /etc/krb5.keytab
  echo Creating /etc/krb5.keytab
  sudo kadmin -p root/admin ext_keytab '*'
}

Still "does not work". And worse: the log file does not clarify what is going wrong.

Any idea?

Thanks a lot :)

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.