NFS (with Kerberos) mount failing due to "Server not found in Kerberos database" error

Question

When running:

sudo mount -t nfs4 -o sec=krb5 sol.domain.com:/ /mnt

I get this error on the client:

mount.nfs4: access denied by server while mounting sol.domain.com:/

And on the server syslogs I read

UNKNOWN_SERVER: authtime 0,  nfs/mercury.domain.com@SOL.DOMAIN.COM for nfs/ip-#-#-#-#.ec2.internal@SOL.DOMAIN.COM, Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/mercury.domain.com@SOL.DOMAIN.COM for krbtgt/EC2.INTERNAL@SOL.DOMAIN.COM, Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/mercury.domain.com@SOL.DOMAIN.COM for krbtgt/INTERNAL@SOL.DOMAIN.COM, Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/mercury.domain.com@SOL.DOMAIN.COM for krbtgt/COM@SOL.DOMAIN.COM, Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/mercury.domain.com@SOL.DOMAIN.COM for krbtgt/DOMAIN.COM@SOL.DOMAIN.COM, Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/mercury.domain.com@SOL.DOMAIN.COM for nfs/ip-#-#-#-#.ec2.internal@SOL.DOMAIN.COM, Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/mercury.domain.com@SOL.DOMAIN.COM for krbtgt/EC2.INTERNAL@SOL.DOMAIN.COM, Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/mercury.domain.com@SOL.DOMAIN.COM for krbtgt/INTERNAL@SOL.DOMAIN.COM, Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/mercury.domain.com@SOL.DOMAIN.COM for krbtgt/COM@SOL.DOMAIN.COM, Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/mercury.domain.com@SOL.DOMAIN.COM for krbtgt/DOMAIN.COM@SOL.DOMAIN.COM, Server not found in Kerberos database

Server keytab file:

ubuntu@sol:~$ sudo klist -e -k /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   7 host/sol.domain.com@SOL.DOMAIN.COM (aes256-cts-hmac-sha1-96) 
   7 host/sol.domain.com@SOL.DOMAIN.COM (arcfour-hmac) 
   7 host/sol.domain.com@SOL.DOMAIN.COM (des3-cbc-sha1) 
   7 host/sol.domain.com@SOL.DOMAIN.COM (des-cbc-crc) 
   9 nfs/sol.domain.com@SOL.DOMAIN.COM (aes256-cts-hmac-sha1-96) 
   9 nfs/sol.domain.com@SOL.DOMAIN.COM (arcfour-hmac) 
   9 nfs/sol.domain.com@SOL.DOMAIN.COM (des3-cbc-sha1) 
   9 nfs/sol.domain.com@SOL.DOMAIN.COM (des-cbc-crc)

Client keytab file:

ubuntu@mercury:~$ sudo klist -e -k /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 host/mercury.domain.com@SOL.DOMAIN.COM (aes256-cts-hmac-sha1-96) 
   3 host/mercury.domain.com@SOL.DOMAIN.COM (arcfour-hmac) 
   3 host/mercury.domain.com@SOL.DOMAIN.COM (des3-cbc-sha1) 
   3 host/mercury.domain.com@SOL.DOMAIN.COM (des-cbc-crc) 
   3 nfs/mercury.domain.com@SOL.DOMAIN.COM (aes256-cts-hmac-sha1-96) 
   3 nfs/mercury.domain.com@SOL.DOMAIN.COM (arcfour-hmac) 
   3 nfs/mercury.domain.com@SOL.DOMAIN.COM (des3-cbc-sha1) 
   3 nfs/mercury.domain.com@SOL.DOMAIN.COM (des-cbc-crc)

please share your /etc/krb5.conf and /var/kerberos/krb5kdc/kdc.conf files from your server and client. — cikuraku, Apr 08 '12 at 09:29
@cikuraku I'm just using the default Ubuntu ones with the exception of adding `allow_weak_crypto = true` to the end. — Kendall Hopkins, Apr 09 '12 at 17:22
Does the ip address for mercury.domain.com reverse to the correct hostname? Does mercury.domain.com have more than one address configured on its interfaces? — larsks, Apr 21 '12 at 00:35
Also...are *any* clients successfully mounting shares from this server? Or is this your only client? — larsks, Apr 21 '12 at 00:36
Does the ip addresses for sol.domain.com and mercury.domain.com have a one correct PTR record set? — bangdang, Apr 27 '12 at 00:08
I didn't set up reverse DNS, but I hardcoded both IPs in the `/etc/hosts` file on both servers. — Kendall Hopkins, Apr 27 '12 at 02:22
Can you add the correct PTR records into DNS for SOL and MERCURY? in general, the SOL and MERCURY should be an A record with one IP address and the PTR record should also point back to SOL and MERCURY and see if that makes a difference? — bangdang, Apr 28 '12 at 23:46

chutz · Answer 1 · 2012-08-27T23:55:34.287

It seems that the reverse name resolution for the IP is not matching the name you are expecting. Make sure that mercury.domain.com and sol.domain.com are the first name that you added to /etc/hosts after the relevant IP address. To be safe, just add a couple of lines on the top with the IP address of the machine and the hostname that kerberos expects.

10.x.y.z sol.domain.com sol ip-blah-blah
10.a.b.c mercury.domain.com mercury ip-other-other

Make sure that both of these lines are present on both the client and the server.

It is also a good idea verify the setup by running the following command on both the client and the server. Make sure that the first hostname printed for each IP address is the one you are expecting.

getent hosts 10.x.y.z 10.a.b.c

NFS (with Kerberos) mount failing due to "Server not found in Kerberos database" error

1 Answers1