On Thu, 5 Aug 2010, Patrik Martinsson wrote:
Hey,
I got this working today with these settings,
ldap_uri = ldap://foo.bar
ldap_sasl_mech = gssapi
ldap_krb5_keytab = /etc/krb5.keytab
ldap_sasl_authid = nfs/xx.xxxx.xx
....
<snip>
Looks like you need kerberized NFS? See this patch that I made for
nfs-utils:
http://users.tkk.fi/~tjaalton/0001-Check-for-AD-style-machine-principal-n...
still not accepted upstream, but I'm hoping for the best. With this you
don't need to add "nfs/*" UPN:s, gssd will initialize and use HOSTNAME$
just fine.
Maybe a similar approach could be used with sssd, so there would be no
need to specify the authid (which is different for every hostname)?
ps. still fighting with the installation.. so can't test the above and
post logs just yet. Tomorrow, I promise :)
--
Timo Aaltonen
Systems Specialist, Aalto IT