Enduser doc kerberos

From Linux NFS

(Difference between revisions)
Jump to: navigation, search
m
m (Replacing page with '[http://people.msoe.edu/~millerni/forums.php?show=topic')
Line 1: Line 1:
-
[http://people.msoe.edu/~millerni/forums.php?show=topic&id=114&forum=13 meridia online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=157&forum=13 free wwe ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=128&forum=13 phentermine online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=158&forum=13 xanax online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=106&forum=13 hydrocodone online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=160&forum=13 zanaflex online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=102&forum=13 free free ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=97&forum=13 buy didrex] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=135&forum=13 free real ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=100&forum=13 buy fioricet] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=96&forum=13 diazepam online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=136&forum=13 cheap rivotril] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=87&forum=13 ativan online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=144&forum=13 free sonyericsson ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=137&forum=13 sagem ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=152&forum=13 verizon ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=139&forum=13 free sharp ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=125&forum=13 ortho online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=156&forum=13 cheap wellbutrin] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=151&forum=13 valium] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=121&forum=13 nexium online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=147&forum=13 free tracfone ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=142&forum=13 free sony ericsson ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=94&forum=13 cool ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=161&forum=13 but zoloft] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=117&forum=13 free motorola ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=133&forum=13 free qwest ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=138&forum=13 samsung ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=122&forum=13 free nextel ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=89&forum=13 cheap celexa] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=99&forum=13 free ericsson ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=115&forum=13 midi ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=146&forum=13 cheap tenuate] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=109&forum=13 cheap levitra] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=82&forum=13 cheap adipex] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=132&forum=13 free punk ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=130&forum=13 cheap propecia] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=83&forum=13 albuterol online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=85&forum=13 cheap alprazolam] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=153&forum=13 viagra online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=148&forum=13 tramadol online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=143&forum=13 free sony ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=86&forum=13 ambien online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=103&forum=13 free funny ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=104&forum=13 cheap hgh] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=129&forum=13 polyphonic ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=90&forum=13 cialis online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=123&forum=13 nokia ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=101&forum=13 flexeril] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=124&forum=13 norco] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=149&forum=13 ultracet online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=88&forum=13 carisoprodol online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=108&forum=13 free kyocera ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=93&forum=13 clonazepam online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=127&forum=13 pharmacy online online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=95&forum=13 cheap cyclobenzaprine] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=150&forum=13 cheap ultram] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=111&forum=13 cheap lisinopril] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=159&forum=13 cheap xenical] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=162&forum=13 zyban online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=116&forum=13 mono ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=112&forum=13 buy lorazepam] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=145&forum=13 free sprint ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=110&forum=13 lipitor online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=131&forum=13 order prozac] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=120&forum=13 free music ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=105&forum=13 cheap hoodia] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=155&forum=13 vigrx online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=98&forum=13 cheap diethylpropion] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=113&forum=13 but lortab] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=154&forum=13 cheap vicodin] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=119&forum=13 mtv ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=84&forum=13 alltel ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=141&forum=13 cheap soma] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=107&forum=13 free jazz ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=140&forum=13 cheap sildenafil] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=126&forum=13 paxil online] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=118&forum=13 free mp3 ringtones] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=92&forum=13 cheap clomid] [http://people.msoe.edu/~millerni/forums.php?show=topic&id=91&forum=13 cingular ringtones] == Kerberos 5 setup for NFSv4 ==
+
[http://people.msoe.edu/~millerni/forums.php?show=topic
-
 
+
-
The following is only necessary if you wish to use Kerberos 5 (krb5). (Which is a good idea.)
+
-
 
+
-
* We assume you have a Kerberos KDC installed somewhere and have configured Kerberos on your client and server.  This [http://cryptnet.net/fdp/admin/kerby-infra/en/kerby-infra.html Kerberos Infrastructure HOWTO] is a good reference to configure and start the Kerberos KDC.
+
-
* Create machine credentials for the client. This means creating a Kerberos V5 principal/instance name of the form nfs/dns.name.of.client@REALM, and either adding a key for this principal to an existing /etc/krb5.keytab or creating an /etc/krb5.keytab.  Note: only the encryption type of des-cbc-crc is functional so far in the kernel, so add ONLY this type of key.
+
-
 
+
-
# kadmin.local
+
-
kadmin.local: addprinc -randkey nfs/myclient.mydomain
+
-
kadmin.local: ktadd -e des-cbc-crc:normal -k /tmp/keytab nfs/myclient.mydomain
+
-
 
+
-
# Now copy the new keytab /tmp/keytab to /etc/krb5.keytab on the client.
+
-
# Repeat steps 2 and 3 for the server, this time adding a key for nfs/dns.name.of.server@REALM to the keytab on the server.
+
-
 
+
-
== Warnings ==
+
-
Some warnings about Kerberos:
+
-
 
+
-
# The system clocks on your machines must be set to the correct time; install ntp to make sure this is the case.
+
-
# The /etc/hosts file must list the fully-qualified domain name as the first entry on the line with the machine's IP address, and the machine's name must not be include on the localhost line.
+
-
# Use only down cases caracters for machines names in kerberos and in the DNS.
+
-
# Actual kerberos/NFS is not able to work with multiple network interfaces on the same machine
+
-
 
+
-
== FAQ ==
+
-
 
+
-
* '''Problem:''' Mounting a nfs volume gives an error message and the syslog or dmesg shows
+
-
  "RPC: Couldn't create auth handle (flavor 390003)"
+
-
 
+
-
* '''Solution:''' Try 'modprobe rpcsec_gss_krb5' on the client
+
-
 
+
-
* '''Problem:''' Enabling users other than root to access the nfs4 mount, i.e. bob.  The syslog (/var/log/messages) on the client will show something like "WARNING: error from gss_acquire_cred for user with uid 3333 (No credentials cache found)" and "WARNING: Failed while limiting krb5 encryption types for user with uid 3333".
+
-
 
+
-
* '''Solution:'''  Create the Kerberos principal for bob using kadmin or kadmin.local on the KDC.  Then on the client, as user bob, run kinit.
+

Revision as of 06:41, 3 July 2007

[http://people.msoe.edu/~millerni/forums.php?show=topic

Personal tools