[SSSD-users] NFS+KERB+SSSD Ubuntu 14.04

John Hodrien J.H.Hodrien at leeds.ac.uk
Mon Aug 11 08:44:11 UTC 2014


On Mon, 11 Aug 2014, Longina Przybyszewska wrote:

> No, not that simple ;( - sorry for  typing  fail.
>
> Mount command:
> mount  -t nfs4 -o rw,sec=krb5 jota.nat.c.example.com:/nfs /nfs
>
> or 'mountall' with the following entry in /etc/fstab :
>
> jota.nat.c.example.com:/nfs	/nfs	nfs4 rw,sec=krb5 0 0
>
> On server /etc/exports:
> /nfs	*(rw,crossmnt,no_subtree_check,sec=krb5)
>
> I can't see there is a 'user' option for nfs mount.

I fail to see how SSSD can be to blame for any of this, as the mount has
nothing to do with mapping users.

I've always gone for an nfs/fqn userPrincipal for both client and server,
which I understand to be a touch outdated with current nfs-utils.  If you're
using AD, it's also important to set the userAccountControl to limit the
kerberos tickets to not include PAC, or else you'll have issues with user
accounts that are members of a significant number of groups.

I think the significant bit is "Wrong principal in request" on the server.

Possibly things to check:

Check kvno lines up correctly for all machine credentials.  When in doubt,
delete the machine objects and start again.

Previously NFS was very limited in what enctypes it could cope with.  Try
again with:

[libdefaults]
default_tkt_enctypes = arcfour-hmac

set in krb5.conf at both ends.

jh


More information about the sssd-users mailing list