Mounting FreeBSD NFSv4 share on Linux using krb5

Rick Macklem rmacklem at uoguelph.ca
Tue May 3 12:32:34 UTC 2016


Julian Andrej wrote:
> Thanks. I will try your suggestions. I got the mount working adding
> "-o vers=3" to the mount. But i have not enough experience to really
> figure out if the "handshake" worked. This way i can mount the share
> AND i need a user TGT to access the mount, so i guess this i correct?
> 
That is correct. At least for the FreeBSD client (and I think the Linux one is
the same), not host-based client credential is needed for a NFSv3 kerberized mount.
(The host based credential is used for the NFSv4 state related ops and there are
 none of those for NFSv3.)
Basically if the NFSv3 mount works and a user with a valid TGT can access
their files, the krb5 stuff is working.

Normally for NFSv4 you need a user TGT as well, to access files after the
mount is done.
--> Hopefully the addition of "krb5i" will fix the NFSv4 case, since the guy
    who found this mentioned NFSv3 worked ok.

Btw, the little patch in head under r298523 might help, although the original
reporter didn't report back w.r.t. whether it helped.
http://svnweb.freebsd.org/base/head/sys/fs/nfsserver/nfs_nfsdsubs.c?r1=297793&r2=298523

> On Tue, May 3, 2016 at 1:57 AM, Rick Macklem <rmacklem at uoguelph.ca> wrote:
> > Julian Andrej wrote:
> >> Hello,
> >>
> >> i'm desperately trying to mount a nfsv4 export from FreeBSD on a Linux
> >> client using sec=krb5.
> >>
> >> So my setup is as follows:
> >> FreeBSD host which is the KDC. Linux client which can auth via
> >> kerberos and should be able to mount the nfs share.
> >>
> >> Mounting the share with sec=krb5 from FreeBSD on another FreeBSD box
> >> is no problem, but it fails on the linux client. The client fails with
> >>
> >> $ sudo mount -t nfs4 -o sec=krb5 ***:/tank/homes mnt -vv
> >> mount.nfs4: timeout set for Mon May  2 15:39:19 2016
> >> mount.nfs4: trying text-based options 'sec=krb5,addr=***,clientaddr=***'
> >> mount.nfs4: mount(2): Input/output error
> >> mount.nfs4: mount system call failed
> >>
> >> and on the FreeBSD host i get the message
> >>
> >> gssd_pname_to_uid: failed major=0xd0000 minor=-1765328227
> > The host based credential maps to "nobody", since it isn't in
> > the passwd database. I'm not sure, but I think that is all this
> > is saying (ie. not what is causing the mount to fail).
> >
> > Someone else discovered that a Linux client actually used krb5i even
> > when krb5 was specified.
> > --> Make sure the /etc/exports on the FreeBSD server specifies
> >    sec=krb5i,krb5 (and not sec=krb5)
> >    --> This will work around this issue.
> > - If you already have both krb5,krb5i specified in your /etc/exports
> >   then I have no idea what the failure is.
> >   - A first step is capturing packets (all of them and not just the
> >     NFS ones) and then looking at them in wireshark. Hopefully that
> >     will give you some idea where it is failing.
> >
> > Good luck. It can bvery difficult to figure out what is causing the
> > failure. Linux clients have been known to work, but I have no idea if
> > all/current ones do?
> >
> > rick
> >
> >> gssd_release_name: done major=0x0 minor=0
> >> gssd_release_cred: done major=0x0 minor=0
> >>
> >> which translates to KRB5_NO_LOCALNAME. I have the appropriate
> >> principals with nfs/* for the host and client!
> >>
> >> I have tried heimdal from base and MIT krb5 from ports. Both show the
> >> same behavior.
> >>
> >> The actual kernel log from linux is:
> >> Mai 02 15:37:19 *** kernel: NFS: nfs4_discover_server_trunking
> >> unhandled error -121. Exiting with error EIO
> >>
> >> Can anyone guide me to a possible solution here?
> >>
> >> Regards
> >> Julian
> >>
> 


More information about the freebsd-fs mailing list