I would like to setup a Kerberized NFSv4 server such that clients do not need a keytab to mount a volume (but such that users get their privileges according to their Kerberos ticket as usual). Is it possible?

More precisely: it is my understanding that in the "usual" setup of Kerberized NFsv4 we have three kinds of principals around.

  • One for the server, named nfs/server.example.com@EXAMPLE.COM.
  • One for each client, named host/client.example.com@EXAMPLE.COM.
  • One for each user, named user@EXAMPLE.COM.

With the client ticket, one can mount the volume, but they cannot acces any file, because privileges are controlled at user level. Once a user has acquired a user ticket, they can actually access the files, subjected to the privileges granted to that principal.

Is this correct? I would like to remove the client ticket, basically saying that every computer can mount the volume (but is of course still subject to having a valid user ticket in order to access the files). Is this possible?

I want to do this because in my setting there are a lot of clients around and they change frequently. I don't want to care about giving a principal and a keytab to all of them and having to keep track of things.

As an intermediate (and only partially satisfying, in my case) solution, it would be acceptable to say that the client still requires a ticket, but there is one wildcard principal that I can distribute to all clients. Something like host/*@EXAMPLE.COM. Is this possible? (I understand that, in general, the Kerberized service checks that the client's principal matches its FQDN name via a reverse DNS lookup query; but in my case my clients might not even have a reverse DNS record).

  • 2
    Well, that wouldn't be Kerberized NFS at all, would it? – Michael Hampton Aug 29 '14 at 14:13
  • 1
    Yes, it would. Users still require a ticket to access their files. I want the server to check user tickets, but not client tickets, in some sense. – Giovanni Mascellani Aug 29 '14 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.