I've got a Linux server (Centos 5.6) that needs to automount home directories from a Windows (Server 2008) NFS share using Kerberos. The share mounts (with the nobody user and group) if authentication is turned off. However, if the -o sec=krb5 flag is passed, I get mount.nfs: permission denied.

As root, I used kinit to get a ticket, and klist tells me that it's a valid ticket. Googling the error didn't give much, as it seems to be a bit of a catch-all. Nothing useful was found in any of the logs I looked in. Root access is set to allowed on the Windows share.

Because of the sharing from Windows thing, a lot of the resources saying to change server settings don't apply as directly.

Any ideas for getting this to work?

  • 1
    Are you sure that windows can export in NFS4? AFAIK you need NFS4 to use kerberos. – wazoox Apr 6 '12 at 21:00
  • Sorry, it's NFS3. Windows - to my knowledge - only supports NFS3. However, the options page for NFS in Windows lists KRB5 and KRB5i as options, so I assumed that it worked. – Ethan Apr 7 '12 at 22:08

The thing that's caught me out - and looks to be the problem you're having- is that root doesn't use ... whatever you get from kinit.

It uses /etc/krb5.keytab, which you can list with klist -kt. Depending on which version of OS you have, it either needs a HOST service principal or - for older versions - needs a nfs service principal.

net ads join and net ads keytab create will do the first part - creating the host keytab. For RHEL 5 I'm pretty sure you need to create an nfs Service Principal on your client, to allow it to access the NFS resource. I would assume the same is true of Centos 5.6, but I'm not 100% sure. I can't give you instructions off the top of my head - I'll have a look and see if I can find more detail. (I've done it, and it definitely works this way on RHEL, but it's long enough ago that if I quoted the instructions, I'd get it wrong).

You can troubleshoot by firing up rpc.gssd -f -vvv

| improve this answer | |

OK, after a bit of research I've found this article that explains how to achieve what you're looking for with a Solaris client. By looking at the client part of this other documentation maybe you could get the whole stuff working...

Apparently from what I've seen from looking around making NFS3 under linux authenticate against kerberos should be possible, contrary to what I thought; however information is incredibly scarce.

In the worst case what's preventing you from using CIFS mount? After it's quite well supported, and documentation abunds.

| improve this answer | |
  • 1
    We tried getting CIFS to work, and while we could get it to mount properly, we were unable to get the PAM module necessary for credentials to work on CentOS 5. I'll be able to test this tomorrow. – Ethan Apr 10 '12 at 17:38
  • 1
    Looked into this, and didn't see anything configured differently. It seems like Windows is misbehaving here, and of course I don't have access to that server. (We can watch the connect come in to Windows and have it do nothing with it) – Ethan Apr 11 '12 at 12:41
  • Hmm, I've heard that the Unix Services sometimes need to be restarted, it may be worth a try... – wazoox Apr 11 '12 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.