On 9/6/19 9:20 PM, Robbie Harwood via FreeIPA-users wrote:
Petros Triantafyllidis via FreeIPA-users
<freeipa-users@lists.fedorahosted.org> writes:

Hi all,
   I have a setup with two servers running CentOS 7.6 which I updated 
recently to ipa-server-4.6.4-10.el7.centos.6.x86_64. The update 
apparently completed successfully and after that I went through the 
update of several clients (ipa-client-4.6.4-10.el7.centos.6.x86_64) some 
of which export kerberized nfs shares. However, after the upgrade, the 
nfs shares are not accessible neither by other clients nor by servers. I 
don't know if it's a coincidence, but I can access only shares exported 
by a non-upgraded client.
When trying to mount by hand from server (:fidias) with admin 
credentials I receive:

[root@fidias]# mount -t nfs4 -o sec=krb5 medusa:/export/teras /teras
mount.nfs4: access denied by server while mounting medusa:/export/teras

[root@fidias]# ipa-getkeytab -r -s fidias.geo.auth.gr -p 
nfs/medusa.geo.auth.gr -k medusa-nfs.keytab
Failed to parse result: Insufficient access rights

Failed to get keytab

[root@fidias]# KRB5_TRACE=/dev/stderr kinit -k -t /etc/krb5.keytab 
nfs/medusa.geo.auth.gr
[26055] 1567693076.930983: Resolving unique ccache of type KEYRING
[26055] 1567693076.930984: Getting initial credentials for 
nfs/medusa.geo.auth.gr@GEO.SS.LAN
[26055] 1567693076.930985: Looked up etypes in keytab: (empty)
[26055] 1567693076.930986: Getting initial credentials for 
nfs/medusa.geo.auth.gr@GEO.SS.LAN
[26055] 1567693076.930987: Looked up etypes in keytab: (empty)
kinit: Keytab contains no suitable keys for 
nfs/medusa.geo.auth.gr@GEO.SS.LAN while getting initial credentials
What's the kvno and enctypes for the keytab?  Do the match that of the
service?

klist -ekt /path/to/keytab, kvno nfs/medusa.geo.auth.gr

Thanks,
--Robbie

Thanks for responding Robbie,
  keytab is the default one and the kvno differs:

[root@medusa]# klist -ekt
Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   1 07/15/2017 09:16:12 host/medusa.geo.auth.gr@GEO.SS.LAN (aes256-cts-hmac-sha1-96)
   1 07/15/2017 09:16:12 host/medusa.geo.auth.gr@GEO.SS.LAN (aes128-cts-hmac-sha1-96)
   1 07/15/2017 09:29:44 nfs/medusa.geo.auth.gr@GEO.SS.LAN (aes256-cts-hmac-sha1-96)
   1 07/15/2017 09:29:44 nfs/medusa.geo.auth.gr@GEO.SS.LAN (aes128-cts-hmac-sha1-96)

[root@medusa]# kvno nfs/medusa.geo.auth.gr
nfs/medusa.geo.auth.gr@GEO.SS.LAN: kvno = 3


On my attempts to fix the problem, I followed the steps below but I am not sure if I did everything as I should. However, the nfs worked after that:

[root@medusa]# kinit admin
[root@medusa]# mv /etc/krb5.keytab /etc/krb5.keytab.orig
[root@medusa]# ipa-getkeytab  -p host/medusa.geo.auth.gr -s fidias.geo.auth.gr -k /etc/krb5.keytab
[root@medusa]# ipa-getkeytab  -p nfs/medusa.geo.auth.gr -s fidias.geo.auth.gr -k /etc/krb5.keytab
[root@medusa]# systemctl restart sssd

Thanks again,
Petros