<div dir="ltr"><div><div><div><div><div><div><div><div><div><div><div>hi,<br><br></div>is nfs with sec=krb5 (krb5i/krb5p, whatever), supposed to work with omnios?<br><br></div>I have been banging my head for a few evenings trying to get this to work, but unfortunately to no avail. It is probably because of me ;-)<br>
<br></div>So I have this omnios vm that I have setup to use a ldap server with ldapclient init, and that works great. I can see all the users in ldap.<br><br></div>Then I edited /etc/nfssec.conf and uncommented all the krb5 lines at the end.<br>
<br></div>Then I created a host and nfs service principal, exported the keytabs and merged them into one principal:<br><br>root@testomnios:~# klist -k -e<br>Keytab name: FILE:/etc/krb5/krb5.keytab<br>KVNO Principal<br>---- --------------------------------------------------------------------------<br>
1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (AES-256 CTS mode with 96-bit SHA-1 HMAC) <br> 1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (AES-128 CTS mode with 96-bit SHA-1 HMAC) <br> 1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (Triple DES cbc mode with HMAC/sha1) <br>
1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (ArcFour with HMAC/md5) <br> 2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (AES-256 CTS mode with 96-bit SHA-1 HMAC) <br> 2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (AES-128 CTS mode with 96-bit SHA-1 HMAC) <br>
2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (Triple DES cbc mode with HMAC/sha1) <br> 2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX (ArcFour with HMAC/md5)<br><br></div>I can kinit with the keytab to both principals<br>
<br>root@testomnios:~# kinit -k<br>root@testomnios:~# klist <br>Ticket cache: FILE:/tmp/krb5cc_0<br>Default principal: host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br><br>Valid starting Expires Service principal<br>
04/12/13 11:56:07 04/13/13 11:56:07 krbtgt/IPA.ASENJO.NX@IPA.ASENJO.NX<br> renew until 04/19/13 11:56:07<br>root@testomnios:~# kinit -k nfs/testomnios.ipa.asenjo.nx<br>root@testomnios:~# klist<br>Ticket cache: FILE:/tmp/krb5cc_0<br>
Default principal: nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br><br>Valid starting Expires Service principal<br>04/12/13 11:56:28 04/13/13 11:56:28 krbtgt/IPA.ASENJO.NX@IPA.ASENJO.NX<br> renew until 04/19/13 11:56:28<br>
<br></div>But on the moment of truth, when I need to share the dataset:<br><br>root@testomnios:~# share -F nfs -o sec=krb5 -d "homedirs" /export/home/<br>Could not share: /export/home: invalid security type<br><br>
# zfs set sharenfs=sec=krb5 rpool/export/home<br>cannot set property for 'rpool/export/home': 'sharenfs' cannot be set to invalid options<br><br></div>But without sec=krb5 (krb5i,krb5p, all 3, whatever), it works a treat<br>
<br>root@testomnios:~# zfs set sharenfs=rw=@192.168 rpool/export/home<br>root@testomnios:~# zfs get sharenfs <br>NAME PROPERTY VALUE SOURCE<br>rpool sharenfs off default<br>
rpool/ROOT sharenfs off default<br>rpool/ROOT/omnios sharenfs off default<br>rpool/ROOT/omnios@install sharenfs - -<br>rpool/ROOT/omniosvar sharenfs off default<br>
rpool/dump sharenfs - -<br>rpool/export sharenfs off default<br>rpool/export/home sharenfs rw=@192.168 local<br><br></div>Any insights greatly appreciated.<br>
<br></div>TIA,<br></div>Natxo<br></div><div class="gmail_extra"><br clear="all"><div>--<br>Groeten,<br>natxo</div>
<br><br><div class="gmail_quote">On Mon, Apr 1, 2013 at 11:10 PM, Natxo Asenjo <span dir="ltr"><<a href="mailto:natxo.asenjo@gmail.com" target="_blank">natxo.asenjo@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div><div><div><div><div><div><div><div>hi,<br><br></div>in a test lab I have joined a omnios vm to a ipa (kerberos/ldap) domain.<br><br></div>this is the omnios version:<br><br># uname -a <br>
SunOS testomnios 5.11 omnios-df542ea i86pc i386 i86pc Solaris<br><br></div>Kerberos authentication works and I can use ldap to search users, getent passwd etc works fine.<br><br></div>I have created an nfs service principal name for the host and added them to the systems' keytab:<br>
<br># klist -k<br>Keytab name: FILE:/etc/krb5/krb5.keytab<br>KVNO Principal<br>---- --------------------------------------------------------------------------<br> 1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br> 1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br>
1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br> 1 nfs/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br> 2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br> 2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br> 2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br>
2 host/testomnios.ipa.asenjo.nx@IPA.ASENJO.NX<br><br></div>I have followed the docs here: <a href="http://docs.oracle.com/cd/E23824_01/html/821-1456/setup-97.html" target="_blank">http://docs.oracle.com/cd/E23824_01/html/821-1456/setup-97.html</a><br>
<br></div>the file /etc/nfssec.conf looks like this:<br><br># default security mode is defined at the end. It should be one of<br># the flavor numbers defined above it.<br>#<br>none 0 - - - # AUTH_NONE<br>
sys 1 - - - # AUTH_SYS<br>dh 3 - - - # AUTH_DH<br>#<br># Uncomment the following lines to use Kerberos V5 with NFS<br>#<br>krb5 390003 kerberos_v5 default - # RPCSEC_GSS<br>
krb5i 390004 kerberos_v5 default integrity # RPCSEC_GSS<br>krb5p 390005 kerberos_v5 default privacy # RPCSEC_GSS<br><br>default 1 - - - # default is AUTH_SYS<br>
<br></div>and finally I try sharing the homedirs but I get this error:<br><br># share -F nfs -o sec=krb5:krb5i:krb5p /export/home<br>Could not share: /export/home: invalid security type<br><br># svcs -l nfs/server<br>fmri svc:/network/nfs/server:default<br>
name NFS server<br>enabled true<br>state online<br>next_state none<br>state_time Mon Apr 1 23:06:09 2013<br>logfile /var/svc/log/network-nfs-server:default.log<br>restarter svc:/system/svc/restarter:default<br>
contract_id 96 <br>dependency require_any/error svc:/milestone/network (online)<br>dependency require_all/error svc:/network/nfs/nlockmgr (online)<br>dependency optional_all/error svc:/network/nfs/mapid (online)<br>
dependency require_all/restart svc:/network/rpc/bind (online)<br>dependency optional_all/none svc:/network/rpc/keyserv (online)<br>dependency optional_all/none svc:/network/rpc/gss (online)<br>dependency optional_all/none svc:/network/shares/group (multiple)<br>
dependency optional_all/none svc:/system/filesystem/reparse (online)<br>dependency require_all/error svc:/system/filesystem/local (online)<br><br></div>How can troubleshoot this? I'm learning a lot about solaris, but still a newbie.<br>
<br></div>TIA,<br clear="all"><div><div><div><div><div><div><div><div><div><div><div><div>--<br>Groeten,<br>natxo</div>
</div></div></div></div></div></div></div></div></div></div></div></div>
</blockquote></div><br></div>