Hello,
it is not clear to me what is the hold up.
Gssproxy can allow you to automatically use a keytab to gain
credentials that then can be used to access a remote NFS server.
Of course the remote NFS server needs to recognize "apache" as a valid
user as well that does have access to user directories for read.
Unfortunately without logs I cannot tell what is wrong.
I think you should add at least cred_usage = initiate to your
configuration.
Please provide logs with errors if you need more help.
Simo.
On Mon, 2020-10-12 at 01:20 +0200, daudel(a)daudel.com wrote:
Hello,
I am in a student context and we use FreeIPA. The station type is fedora
31.
All profiles (home directories) are stored on an NFS kerberised crypted
share.
Students have personnal web pages on the NFS share with ~student_name1,
~student_name2, ...
The local httpd needs a TGT somwhere and i suppose, gssproxy is the good
approach.
I have try a lot of things with gssproxy to allow local httpd tu access
the pages with no real success.
Here is "the best" i had, but it's not very usable.
I suppose, it existes a nicer way ?
Merci beaucoup
The file is for automatic deployment : gssproxy part + sudo part for
students
I did a setup of un ipa account apache 48/48
#!/usr/bin/bash
kinit_admin(){
kinit admin <<EOF
xxxxxxx
EOF
}
apache_nfs(){
# A - gssproxy part
kinit_admin
rm -f /etc/gssproxy/httpd.keytab
ipa-getkeytab -s $( awk '/^server/ { print $3 }' /etc/ipa/default.conf )
-k /etc/gssproxy/httpd.keytab -p apache(a)MYDOMAIN.FR
kdestroy
#
# 80-httpd.conf
#
cat >/etc/gssproxy/80-httpd.conf <<ESC
[service/apache]
mechs = krb5
cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_48
cred_store = client_keytab:/etc/gssproxy/httpd.keytab
euid = 48
ESC
mkdir /etc/systemd/system/httpd.service.d
cat >/etc/systemd/system/httpd.service.d/48-httpd.conf <<ESC
[Service]
Environment=GSS_USE_PROXY=1
ESC
/usr/bin/systemctl daemon-reload
/usr/bin/systemctl restart httpd
# B - sudo part
#
# sudo script gsproxy.sh in /usr/bin
#
cat >/usr/bin/gsproxy.sh <<ESC
/usr/bin/kinit \$(/usr/bin/logname)
if [ \$? -gt 0 ] ; then
/usr/bin/echo "Password error"
/usr/bin/echo "Restart sudo"
exit 1
fi
/usr/bin/kdestroy -c /var/lib/gssproxy/clients/krb5cc_48
/usr/bin/kinit -k -t /etc/gssproxy/httpd.keytab -c
/var/lib/gssproxy/clients/krb5cc_48 -p apache(a)MYDOMAIN.FR
/usr/bin/kdestroy
ESC
#
# sudo file
#
echo '%utilisateurs ALL = /usr/bin/gsproxy.sh'
>/etc/sudoers.d/gsproxy
chmod +x /usr/bin/gsproxy.sh
}
_______________________________________________
gss-proxy mailing list -- gss-proxy(a)lists.fedorahosted.org
To unsubscribe send an email to gss-proxy-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/gss-proxy@lists.fedorahosted...
--
Simo Sorce
RHEL Crypto Team
Red Hat, Inc