nfs4 Kerberos화된 공유를 마운트하고 싶습니다. 저는 centos7을 사용하고 있고 kerberos 서버는 Freeipa이고 클라이언트는 centos7입니다. 문제는 내 구성이 nfs3에서는 작동하지만 nfs4에서는 작동하지 않는다는 것입니다. 먼저 구성을 넣었습니다.
/etc/export
/export 10.2.0.0/24(ro,no_subtree_check,fsid=0,)
/export/public 10.2.0.0/24(ro,no_subtree_check,async,root_squash,nohide,sec=sys)
/export/private 10.2.0.0/24(ro,no_subtree_check,async,root_squash,nohide,sec=krb5p)
/etc/nfsmount.conf
[ NFSMount_Global_Options ]
Defaultvers=4
Defaultproto=tcp
mountport=4001
Port=2049
/etc/krb5.conf
#File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = MYREALM.FAKE
dns_lookup_realm = true
dns_lookup_kdc = true
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
MYREALM.FAKE = {
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.myrealm.fake = MYREALM.FAKE
myrealm.fake = MYREALM.FAKE
centos1.myrealm.fake = MYREALM.FAKE
열쇠를 얻었어요
echo mypassword|kinit myuser
klist 보고서는 정상입니다
이제 kerberos+nfs4 없이 "public"을 마운트해 보십시오.
mount -t nfs centos1:/public /mnt/ -vvv
mount.nfs: timeout set for Sat Mar 2 14:23:05 2019
mount.nfs: trying text-based options 'mountport=4001,port=2049,vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'
괜찮은
이제 "공개"에는 kerberos+nfs3이 없습니다.
mount -t nfs centos1:/export/public /mnt/ -vvv
mount.nfs: timeout set for Sat Mar 2 14:26:41 2019
mount.nfs: trying text-based options 'vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'
mount.nfs: mount(2): No such file or directory
mount.nfs: trying text-based options 'addr=10.2.0.77'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: trying 10.2.0.77 prog 100003 vers 3 prot TCP port 2049
mount.nfs: prog 100005, trying vers=3, prot=17
mount.nfs: trying 10.2.0.77 prog 100005 vers 3 prot UDP port 20048
괜찮은
이제 kerberos+nfs3에 대해 "비공개"입니다.
mount -t nfs centos1:/export/private /mnt/ -vvv
mount.nfs: timeout set for Sat Mar 2 14:28:05 2019
mount.nfs: trying text-based options 'vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'
mount.nfs: mount(2): No such file or directory
mount.nfs: trying text-based options 'addr=10.2.0.77'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: trying 10.2.0.77 prog 100003 vers 3 prot TCP port 2049
mount.nfs: prog 100005, trying vers=3, prot=17
mount.nfs: trying 10.2.0.77 prog 100005 vers 3 prot UDP port 20048
괜찮아요.
문제는 nfs4를 사용하려고 할 때입니다.
mount -t nfs4 centos1:/private /mnt/ -vvv
mount.nfs4: timeout set for Sat Mar 2 14:29:54 2019
mount.nfs4: trying text-based options 'vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'
mount.nfs4: mount(2): Operation not permitted
mount.nfs4: Operation not permitted
다른 클라이언트에서도 시도했는데 ipa 서버에서 동일한 오류가 보고되었습니다.
Mar 02 14:29:12 freeipa.realm.fake krb5kdc[611](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.2.0.77: NEEDED_PREAUTH: [email protected] for krbtgt/[email protected], Additional pre-authentication required
Mar 02 14:29:12 freeipa.realm.fake krb5kdc[611](info): closing down fd 11
Mar 02 14:29:12 freeipa.realm.fake krb5kdc[611](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.2.0.77: ISSUE: authtime 1551533352, etypes {rep=18 tkt=18 ses=18}, [email protected] for krbtgt/[email protected]
Mar 02 14:29:12 freeipa.realm.fake krb5kdc[611](info): closing down fd 11
nfs kerberized가 nfs3에서만 작동하는 이유는 무엇입니까? 나는 Firewalld와 selinux를 비활성화하려고 시도했습니다. 같은 일입니다.
답변1
해결책을 찾았습니다. /etc/exports를 다음과 같이 편집했습니다.
/export 10.2.0.0/24(ro,no_subtree_check,fsid=0,sec=krb5p:sys)
/export/private 10.2.0.0/24(ro,no_subtree_check,async,root_squash,nohide,sec=krb5p)
/export/public 10.2.0.0/24(ro,no_subtree_check,async,root_squash,nohide,sec=sys)
이제 완벽하게 작동합니다.
mount -vvv -t nfs4 -o sec=krb5p centos1.myrealm.fake:/private /mnt
mount.nfs4: timeout set for Sun Mar 3 09:59:06 2019
mount.nfs4: trying text-based options 'sec=krb5p,vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'
umount /mnt
mount -vvv -t nfs4 -o sec=sys centos1.myrealm.fake:/public /mnt
mount.nfs4: timeout set for Sun Mar 3 09:59:19 2019
mount.nfs4: trying text-based options 'sec=sys,vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'