Hi all,
I have a setup with two servers running CenOS 7.6 which I updated
recently to ipa-server-4.6.4-10.el7.centos.6.x86_64. The update
apparently completed successfully and after that I went through the
update of several clients (ipa-client-4.6.4-10.el7.centos.6.x86_64) some
of which export kerberized nfs shares. However, after the upgrade, the
nfs shares are not accessible neither by other clients nor by servers. I
don't know if it's a coincidence, but I can access only shares exported
by a non-upgraded client.
When trying to mount by hand from server (:fidias) with admin
credentials I receive:
[root@fidias]# mount -t nfs4 -o sec=krb5 medusa:/export/teras /teras
mount.nfs4: access denied by server while mounting medusa:/export/teras
[root@fidias]# ipa-getkeytab -r -s fidias.geo.auth.gr -p
nfs/medusa.geo.auth.gr -k medusa-nfs.keytab
Failed to parse result: Insufficient access rights
Failed to get keytab
[root@fidias]# KRB5_TRACE=/dev/stderr kinit -k -t /etc/krb5.keytab
nfs/medusa.geo.auth.gr
[26055] 1567693076.930983: Resolving unique ccache of type KEYRING
[26055] 1567693076.930984: Getting initial credentials for
nfs/medusa.geo.auth.gr(a)GEO.SS.LAN
[26055] 1567693076.930985: Looked up etypes in keytab: (empty)
[26055] 1567693076.930986: Getting initial credentials for
nfs/medusa.geo.auth.gr(a)GEO.SS.LAN
[26055] 1567693076.930987: Looked up etypes in keytab: (empty)
kinit: Keytab contains no suitable keys for
nfs/medusa.geo.auth.gr(a)GEO.SS.LAN while getting initial credentials
How can this be fixed?
Thanks in advance,
Petros
--
Dr. TRIANTAFYLLIDIS PETROS
Aristotle University - Department of Geophysics, POBox 112,
54124 Thessaloniki,GREECE-TEL:+30-2310998585,FAX:2310991403