Hi, On my Ubuntu workstation client I've been able to kerberize NFSv4 mounts.
Basically It is needed to create princ and keytab for nfs/yourclient.intern. The princ for the nfs server is already existent as nfs/tjener.intern, but adding the keytab is needed. Keytab can go to default krb5.keytab, since nfs runs as root. No need to add kerberos autentication of the autofs service, like stated somewhere in internet (autofsclient principal and keytab). Important is the "ktadd -e des" options for all nfs/xxx.intern since nfsv4 works only with des, and the allow_weak_crypto = true in krb5.conf. Then modify ldap options "automountInformation: -fstype=nfs4,sec=krb5,rw tjener.intern:/&" The rest is rebooting two or three times (no idea why, both tjener and client), and checking the mount options with "mount" command. At this stage I guess that it is possible to remove the sys option in/etc/exports on tjener. ( Not tried yet, for sake of compatibility with other client images). Regards Giorgio P.S: Next would be to use authentication without TGT and avoiding the keytab for client and server. -- Sysadmin SPSE-Tenero Ufficio: +41 91 735 62 48 Cellulare: +41 79 629 20 63 -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]
