I'm on CentOS 6.4. Using kstart I have a TGT kept active using the machine account (ie computername$) from Active Directory. The ticket cache is assigned to root and is located at /tmp/krb5cc_0. I mount.cifs as root using sec=krb5. This works and I can browse the share.

The problem is that while a user can browse the share fine via ssh, rsync running under cron can't access it after its already been mounted. Nor can the Subversion Edge backup function. Rsync gets error:

rsync: ERROR: cannot stat destination "/mnt/dfs/backups/redmine/": Key has been revoked (128)

and csvn's backup gets the same 128 error:

CIFS VFS: Send error in SessSetup = -128
CIFS VFS: cifs_mount failed w/return code = -128

and sometimes a

CIFS VFS: Send error in SessSetup = -122
CIFS VFS: cifs_mount failed w/return code = -122

which I think means no quota.

I've tried disabling SELinux, so that's not the issue. How can I get these "background tasks" to be able to use a Kerberos CIFS share?

  • Does it work if you manually mount it and run the rsync job yourself as root (so it's not a time out issue)? Someone here permalink.gmane.org/gmane.linux.kernel.cifs/8592 had the same issue, it looks like the kerberos tickets are not renewing or being used properly by cifs.upcall – TheFiddlerWins Sep 5 '13 at 20:34
  • Yes, it works if I manually mount it. I think I'm having a different issue. For me the automatic TGT retrieval that cifs.upcall supposedly does has never worked so I use kstart to keep my root TGT active. – Doug Oct 7 '13 at 17:04

Cron isn't using the ticket cache, either because it doesn't know to (KRB5CCNAME isn't set or passed to the job) or it can't read the cache (permissions on the cache prevent the user the job is running as from reading it).

  • This was a good idea, and I tried exporting KRB5CCNAME=/tmp/krb5cc_0 in the cron job, but it doesn't look like that is the issue. I'm not using a multiuser mount, so I don't think it matters what credentials the user doing the access has. I'm using autofs to mount it and the user and group are set to root. – Doug Oct 8 '13 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.