Petros Triantafyllidis via FreeIPA-users <freeipa-users@lists.fedorahosted.org> writes:Hi all, I have a setup with two servers running CentOS 7.6 which I updated recently to ipa-server-4.6.4-10.el7.centos.6.x86_64. The update apparently completed successfully and after that I went through the update of several clients (ipa-client-4.6.4-10.el7.centos.6.x86_64) some of which export kerberized nfs shares. However, after the upgrade, the nfs shares are not accessible neither by other clients nor by servers. I don't know if it's a coincidence, but I can access only shares exported by a non-upgraded client. When trying to mount by hand from server (:fidias) with admin credentials I receive: [root@fidias]# mount -t nfs4 -o sec=krb5 medusa:/export/teras /teras mount.nfs4: access denied by server while mounting medusa:/export/teras [root@fidias]# ipa-getkeytab -r -s fidias.geo.auth.gr -p nfs/medusa.geo.auth.gr -k medusa-nfs.keytab Failed to parse result: Insufficient access rights Failed to get keytab [root@fidias]# KRB5_TRACE=/dev/stderr kinit -k -t /etc/krb5.keytab nfs/medusa.geo.auth.gr [26055] 1567693076.930983: Resolving unique ccache of type KEYRING [26055] 1567693076.930984: Getting initial credentials for nfs/medusa.geo.auth.gr@GEO.SS.LAN [26055] 1567693076.930985: Looked up etypes in keytab: (empty) [26055] 1567693076.930986: Getting initial credentials for nfs/medusa.geo.auth.gr@GEO.SS.LAN [26055] 1567693076.930987: Looked up etypes in keytab: (empty) kinit: Keytab contains no suitable keys for nfs/medusa.geo.auth.gr@GEO.SS.LAN while getting initial credentialsWhat's the kvno and enctypes for the keytab? Do the match that of the service? klist -ekt /path/to/keytab, kvno nfs/medusa.geo.auth.gr Thanks, --Robbie
Thanks for responding Robbie,
keytab is the default one and the kvno differs:
[root@medusa]# klist
-ekt
Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp Principal
---- -------------------
------------------------------------------------------
1 07/15/2017 09:16:12 host/medusa.geo.auth.gr@GEO.SS.LAN
(aes256-cts-hmac-sha1-96)
1 07/15/2017 09:16:12 host/medusa.geo.auth.gr@GEO.SS.LAN
(aes128-cts-hmac-sha1-96)
1 07/15/2017 09:29:44 nfs/medusa.geo.auth.gr@GEO.SS.LAN
(aes256-cts-hmac-sha1-96)
1 07/15/2017 09:29:44 nfs/medusa.geo.auth.gr@GEO.SS.LAN
(aes128-cts-hmac-sha1-96)
[root@medusa]# kvno
nfs/medusa.geo.auth.gr
nfs/medusa.geo.auth.gr@GEO.SS.LAN: kvno = 3
On my attempts to fix the problem, I followed the steps below but
I am not sure if I did everything as I should. However, the nfs
worked after that:
[root@medusa]# kinit
admin
[root@medusa]# mv /etc/krb5.keytab /etc/krb5.keytab.orig
[root@medusa]# ipa-getkeytab -p host/medusa.geo.auth.gr -s
fidias.geo.auth.gr -k /etc/krb5.keytab
[root@medusa]# ipa-getkeytab -p nfs/medusa.geo.auth.gr -s
fidias.geo.auth.gr -k /etc/krb5.keytab
[root@medusa]# systemctl restart sssd
Thanks again,
Petros