You are not logged in.
Without Kerberos NFSv4 works with my setup.
When I change NFS to use Kerberos the mount command never finishes and, naturally, I am not able to mount the nfs shares. The mount command seems not to finish any any reasonable time.
I have two machines and the NFS server and KDC is running on another and, naturally, the NFS client is the other. The same issue occurs regardles if I'm using the NFS server or the actual NFS client to mount the NFS share. There is no active firewall between the computers.
My Kerberos is able to create tickets and when mount command like "mount -t nfs -o sec=krb5i nfsserver.mydomain.com:/ /mnt/nfs" is issued the following entries are written to KDC log:
Aug 03 08:49:28 nfsserver.mydomain.com krb5kdc[895](info): AS_REQ (4 etypes {18 17 16 23}) 10.1.9.102: ISSUE: authtime 1343972968, etypes {rep=18 tkt=18 ses=18}, nfs/nfsclient.mydomain.com@MYDOMAIN.COM for krbtgt/MYDOMAIN.COM@MYDOMAIN.COM
Aug 03 08:49:28 nfsserver.mydomain.com krb5kdc[895](info): TGS_REQ (4 etypes {18 17 16 23}) 10.1.9.102: ISSUE: authtime 1343972968, etypes {rep=18 tkt=18 ses=18}, nfs/nfsclient.mydomain.com@MYDOMAIN.COM for nfs/nfsclient.mydomain.com@MYDOMAIN.COMAnd the following appears in syslogs (this is from mount command run on the nfs server):
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: dir_notify_handler: sig 37 si 0xbef91810 data 0xbef91890
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: dir_notify_handler: sig 37 si 0xbef91810 data 0xbef91890
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: dir_notify_handler: sig 37 si 0xbef8bf88 data 0xbef8c008
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: dir_notify_handler: sig 37 si 0xbef8bf88 data 0xbef8c008
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: dir_notify_handler: sig 37 si 0xbef91810 data 0xbef91890
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: handling gssd upcall (/var/lib/nfs/rpc_pipefs/nfs/clnta)
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 '
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: handling krb5 upcall (/var/lib/nfs/rpc_pipefs/nfs/clnta)
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: process_krb5_upcall: service is '<null>'
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: Full hostname for 'nfsserver.mydomain.com' is 'nfsserver.mydomain.com'
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: Full hostname for 'nfsserver.mydomain.com' is 'nfsserver.mydomain.com'
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: No key table entry found for nfsserver.MYDOMAIN.COM$@MYDOMAIN.COM while getting keytab entry for 'nfsserver.MYDOMAIN.COM$@MYDOMAIN.COM'
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: No key table entry found for root/nfsserver.mydomain.com@MYDOMAIN.COM while getting keytab entry for 'root/nfsserver.mydomain.com@MYDOMAIN.COM'
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: Success getting keytab entry for 'nfs/nfsserver.mydomain.com@MYDOMAIN.COM'
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: Successfully obtained machine credentials for principal 'nfs/nfsserver.mydomain.com@MYDOMAIN.COM' stored in ccache 'FILE:/tmp/krb5cc_machine_MYDOMAIN.COM'
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_MYDOMAIN.COM' are good until 1344008605
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: using FILE:/tmp/krb5cc_machine_MYDOMAIN.COM as credentials cache for machine creds
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: using environment variable to select krb5 ccache FILE:/tmp/krb5cc_machine_MYDOMAIN.COM
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: creating context using fsuid 0 (save_uid 0)
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: creating tcp client for server nfsserver.mydomain.com
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: DEBUG: port already set to 2049
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: creating context with server nfs@nfsserver.mydomain.com
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: leaving poll
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: handling null request
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: svcgssd_limit_krb5_enctypes: Calling gss_set_allowable_enctypes with 7 enctypes from the kernel
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: sname = nfs/nfsserver.mydomain.com@MYDOMAIN.COM
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: DEBUG: serialize_krb5_ctx: lucid version!
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: prepare_krb5_rfc4121_buffer: protocol 1
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: doing downcall
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: mech: krb5, hndl len: 4, ctx len 52, timeout: 1344008605 (36000 from now), clnt: nfs@nfsserver.mydomain.com, uid: -1, gid: -1, num aux grps: 0:
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: sending null reply
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: writing message: \x \x6082028406092a864886f71201020201006e8202733082026fa003020105a10302010ea20703050020000000a38201726182016e3082016aa003020105a10d1b0b4a524f4f2e494b492e4649a2273025a003020103a11e301c1b036e66731b15647265616d706c75672e6a726f6f2e696b692e6669a382012930820125a003020112a103020102a28201170482011317f306504878e9489d6b80cf3f76da219fb5219f6dbb0f0f31b8274bfc3b15e1847d43436f3dccbc00600ce7b318621e0b77caf8f148db723b271fa03d0cac723cccf2bf68b9a0a8f4229578a434f596bf99a8272c1a458f417e325e4318dd766fa67eb8f4bc105689140960666c71f16b42647d4f7280d1cdd2548095c872f596f4cd962b21e4346717fc60ce9498f11c775f53a19eed7f1e8a05e1697b817e76afbb759e74b630dac63fd6b4c7011222c29dd5d70239b4131a34fbea1e35e43bfbaaab70030bc0283c719a5aa095a403cd9ba3ae418dd82f1ffd527025dd342cce6bbaea696ce4a1572e6d5c1b8036afa85937599458b5d983b59753a9b9b6a6f97c49f57605e12e2cdcca7766fc10662363a481e33081e0a003020112a281d80481d5436ceb35c0d89236bb8cf19245dc042221fa410321f915881e7a18c36fadd626aee187405d15064632d4c911fd4777c68f4dded8422f57cbce5a54c7dc2339dca2dbf9975d6fa098d43cda8a8c9c4f1153a69ea2cfc11d1c55351dc6c3d61a398ea2b66c7b36a1c336a7b81996039b24fbed9dbd362702826cb59349b72c4b322ea9e058aa81a73e3cbf4677dc0350549f72f0240cebc09e63c35fbc081e6297a52429a03fba1e6d05b66e9bede721d7eec169d115015fa86d09d2910b2bc02593d2e871803fd8b7a5c97ec7d3ebb884132e7bed55 1343972665 0 0 \x01000000 \x60819906092a864886f71201020202006f8189308186a003020105a10302010fa27a3078a003020112a271046fb2d8b98fc3eaeb19160fe7c140f0a61f533be0dd9355d761930a1df3d2fadcc759ebbd69e17593f31c8f11aa5686f18a4fa15372e78c69eb021b22061a639164220d8f17bff10555ab796d7c659b52cc0281d2dcad62385a0fc9383654e54c17443a5cff65d11d61a6def88ef11f25
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: DEBUG: serialize_krb5_ctx: lucid version!
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: finished handling null request
Aug 3 08:43:25 nfsserver rpc.svcgssd[4880]: entering poll
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: prepare_krb5_rfc4121_buffer: protocol 1
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32
Aug 3 08:43:25 nfsserver rpc.gssd[4804]: doing downcall/etc/conf.d/nfs-common.conf
# Parameters to be passed to nfs-common (nfs clients & server) init script.
#
# If you do not set values for the NEED_ options, they will be attempted
# autodetected; this should be sufficient for most people. Valid alternatives
# for the NEED_ options are "yes" and "no".
# Do you want to start the statd daemon? It is not needed for NFSv4.
NEED_STATD=""
# Options to pass to rpc.statd.
# See rpc.statd(8) for more details.
# N.B. statd normally runs on both client and server, and run-time
# options should be specified accordingly.
# STATD_OPTS="-p 32765 -o 32766"
STATD_OPTS=""
# Options to pass to sm-notify
# e.g. SMNOTIFY_OPTS="-p 32764"
SMNOTIFY_OPTS=""
# Do you want to start the idmapd daemon? It is only needed for NFSv4.
NEED_IDMAPD="yes"
# Options to pass to rpc.idmapd.
# See rpc.idmapd(8) for more details.
IDMAPD_OPTS=""
# Do you want to start the gssd daemon? It is required for Kerberos mounts.
NEED_GSSD="yes"
# Options to pass to rpc.gssd.
# See rpc.gssd(8) for more details.
GSSD_OPTS="-vvv"
# Where to mount rpc_pipefs filesystem; the default is "/var/lib/nfs/rpc_pipefs".
PIPEFS_MOUNTPOINT=""
# Options used to mount rpc_pipefs filesystem; the default is "defaults".
PIPEFS_MOUNTOPTS=""/etc/conf.d/nfs-server.conf
# Parameters to be passed to nfs-server init script.
#
# Options to pass to rpc.nfsd.
# See rpc.nfsd(8) for more details.
NFSD_OPTS=""
# Number of servers to start up; the default is 8 servers.
NFSD_COUNT=""
# Where to mount nfsd filesystem; the default is "/proc/fs/nfsd".
PROCNFSD_MOUNTPOINT=""
# Options used to mount nfsd filesystem; the default is "rw,nodev,noexec,nosuid".
PROCNFSD_MOUNTOPTS=""
# Options for rpc.mountd.
# If you have a port-based firewall, you might want to set up
# a fixed port here using the --port option.
# See rpc.mountd(8) for more details.
MOUNTD_OPTS=""
# Do you want to start the svcgssd daemon? It is only required for Kerberos
# exports. Valid alternatives are "yes" and "no"; the default is "no".
NEED_SVCGSSD="yes"
# Options to pass to rpc.svcgssd.
# See rpc.svcgssd(8) for more details.
SVCGSSD_OPTS="-vvv"/etc/exports:
/exports gss/krb5i(rw,no_subtree_check,sync,fsid=0,crossmnt)
/exports/home gss/krb5i(rw,no_subtree_check,sync,nohide)Offline