On 9/6/19 9:20 PM, Robbie Harwood via FreeIPA-users wrote:
Petros Triantafyllidis via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> writes:
> Hi all,
> I have a setup with two servers running CentOS 7.6 which I updated
> recently to ipa-server-4.6.4-10.el7.centos.6.x86_64. The update
> apparently completed successfully and after that I went through the
> update of several clients (ipa-client-4.6.4-10.el7.centos.6.x86_64) some
> of which export kerberized nfs shares. However, after the upgrade, the
> nfs shares are not accessible neither by other clients nor by servers. I
> don't know if it's a coincidence, but I can access only shares exported
> by a non-upgraded client.
> When trying to mount by hand from server (:fidias) with admin
> credentials I receive:
>
> [root@fidias]# mount -t nfs4 -o sec=krb5 medusa:/export/teras /teras
> mount.nfs4: access denied by server while mounting medusa:/export/teras
>
> [root@fidias]# ipa-getkeytab -r -s fidias.geo.auth.gr -p
> nfs/medusa.geo.auth.gr -k medusa-nfs.keytab
> Failed to parse result: Insufficient access rights
>
> Failed to get keytab
>
> [root@fidias]# KRB5_TRACE=/dev/stderr kinit -k -t /etc/krb5.keytab
> nfs/medusa.geo.auth.gr
> [26055] 1567693076.930983: Resolving unique ccache of type KEYRING
> [26055] 1567693076.930984: Getting initial credentials for
> nfs/medusa.geo.auth.gr(a)GEO.SS.LAN
> [26055] 1567693076.930985: Looked up etypes in keytab: (empty)
> [26055] 1567693076.930986: Getting initial credentials for
> nfs/medusa.geo.auth.gr(a)GEO.SS.LAN
> [26055] 1567693076.930987: Looked up etypes in keytab: (empty)
> kinit: Keytab contains no suitable keys for
> nfs/medusa.geo.auth.gr(a)GEO.SS.LAN while getting initial credentials
What's the kvno and enctypes for the keytab? Do the match that of the
service?
klist -ekt /path/to/keytab, kvno nfs/medusa.geo.auth.gr
Thanks,
--Robbie
Thanks for responding Robbie,
keytab is the default one and the kvno differs:
[root@medusa]# klist -ekt
Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp Principal
---- -------------------
------------------------------------------------------
1 07/15/2017 09:16:12 host/medusa.geo.auth.gr(a)GEO.SS.LAN
(aes256-cts-hmac-sha1-96)
1 07/15/2017 09:16:12 host/medusa.geo.auth.gr(a)GEO.SS.LAN
(aes128-cts-hmac-sha1-96)
1 07/15/2017 09:29:44 nfs/medusa.geo.auth.gr(a)GEO.SS.LAN
(aes256-cts-hmac-sha1-96)
1 07/15/2017 09:29:44 nfs/medusa.geo.auth.gr(a)GEO.SS.LAN
(aes128-cts-hmac-sha1-96)
[root@medusa]# kvno nfs/medusa.geo.auth.gr
nfs/medusa.geo.auth.gr(a)GEO.SS.LAN: kvno = 3
On my attempts to fix the problem, I followed the steps below but I am
not sure if I did everything as I should. However, the nfs worked after
that:
[root@medusa]# kinit admin
[root@medusa]# mv /etc/krb5.keytab /etc/krb5.keytab.orig
[root@medusa]# ipa-getkeytab -p host/medusa.geo.auth.gr -s
fidias.geo.auth.gr -k /etc/krb5.keytab
[root@medusa]# ipa-getkeytab -p nfs/medusa.geo.auth.gr -s
fidias.geo.auth.gr -k /etc/krb5.keytab
[root@medusa]# systemctl restart sssd
Thanks again,
Petros