Rob Kampen wrote:
On 07/19/2011 04:43 PM, Olaf Mueller wrote:
Rob Kampen wrote:
Hello,
nfs4 with kerberos works fine here on CentOS 5.6.
change exports to [...]gss/krb([...] [...]gss/krb([...]
My /etc/exports says '... gss/krb5(...'.
Got this already
And 'SECURE_NFS="yes"' is set in /etc/sysconfig/nfs.
This too is set
All needed services are running?
- rpcsvcgssd (server)
- rpcidmapd (server)
- rpcgssd (client)
Yes all running
A very good instruction, in my opinion, to get it running is http://sadiquepp.blogspot.com/2009/02/how-to-configure-nfsv4-with-kerberos-i....
This was one of the ones I used - will start from the beginning again. Thanks for comments
regards Olaf
I have put the nfs4 with Kerberos on hold as it seems there may be a problem with the basic kerberos install. I have chased many dozen of references (most seems at least 4 years old) and worked step-by-step through their examples only to find problems. I have a master KDC set up on an older i386 box (uptodate 5.6) that also runs centos-directory-server (not yet functioning) and also runs as my DNS master (not internet accessible). It appears to be running as advertised. So before I go live, all the docs recommend having at least one slave per lan segment, so I thought that should be easy. I followed http://tldp.org/HOWTO/Kerberos-Infrastructure-HOWTO/server-replication.html and also http://www.linuxtopia.org/online_books/linux_system_administration/kerberos_... and find I cannot get past this error: /usr/kerberos/sbin/kprop: Decrypt integrity check failed while getting initial ticket the kdc log shows the principal I'm missing, and sure enough
kvno host/www.nealdevelopment.com
host/www.nealdevelopment.com@NDGONLINE.NET: kvno = 5 yet
sudo klist -k /etc/krb5.keytab |grep www
3 host/www.nealdevelopment.com@NDGONLINE.NET 3 host/www.nealdevelopment.com@NDGONLINE.NET 3 host/www.nealdevelopment.com@NDGONLINE.NET 3 host/www.nealdevelopment.com@NDGONLINE.NET 4 host/www.nealdevelopment.com@NDGONLINE.NET 4 host/www.nealdevelopment.com@NDGONLINE.NET 4 host/www.nealdevelopment.com@NDGONLINE.NET 4 host/www.nealdevelopment.com@NDGONLINE.NET 6 host/www.nealdevelopment.com@NDGONLINE.NET 6 host/www.nealdevelopment.com@NDGONLINE.NET 6 host/www.nealdevelopment.com@NDGONLINE.NET 6 host/www.nealdevelopment.com@NDGONLINE.NET sure enough the version numbers do not match so I do another kadmin ktadd to add the appropriate ticket to the keytab only to find it bumps the version number What on earth am I missing!!! I just cannot seems to get the numbers to match!! As you can see my patience is all gone - I'm obviously missing something basic. BTW, I have tried both copying and generating local keytabs - neither solve the problem - documentation varies and some say only do it this way and others say another - in my case none work. There is thus some magic foo I am not able to discern. All help appreciated.
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos