Hi all,
I have a setup with two servers running CenOS 7.6 which I
updated recently to ipa-server-4.6.4-10.el7.centos.6.x86_64. The
update apparently completed successfully and after that I went
through the update of several clients
(ipa-client-4.6.4-10.el7.centos.6.x86_64) some of which export
kerberized nfs shares. However, after the upgrade, the nfs shares
are not accessible neither by other clients nor by servers. I
don't know if it's a coincidence, but I can access only shares
exported by a non-upgraded client.
When trying to mount by hand from server (:fidias) with admin
credentials I receive:
[root@fidias]# mount
-t nfs4 -o sec=krb5 medusa:/export/teras /teras
mount.nfs4: access denied by server while mounting
medusa:/export/teras
[root@fidias]#
ipa-getkeytab -r -s fidias.geo.auth.gr -p nfs/medusa.geo.auth.gr
-k medusa-nfs.keytab
Failed to parse result: Insufficient access rights
Failed to get keytab
[root@fidias]#
KRB5_TRACE=/dev/stderr kinit -k -t /etc/krb5.keytab
nfs/medusa.geo.auth.gr
[26055] 1567693076.930983: Resolving unique ccache of type
KEYRING
[26055] 1567693076.930984: Getting initial credentials for
nfs/medusa.geo.auth.gr@GEO.SS.LAN
[26055] 1567693076.930985: Looked up etypes in keytab: (empty)
[26055] 1567693076.930986: Getting initial credentials for
nfs/medusa.geo.auth.gr@GEO.SS.LAN
[26055] 1567693076.930987: Looked up etypes in keytab: (empty)
kinit: Keytab contains no suitable keys for
nfs/medusa.geo.auth.gr@GEO.SS.LAN while getting initial
credentials
How can this be fixed?
Thanks in advance,
Petros
-- Dr. TRIANTAFYLLIDIS PETROS Aristotle University - Department of Geophysics, POBox 112, 54124 Thessaloniki,GREECE-TEL:+30-2310998585,FAX:2310991403