Permissions are not taking effect with Kerberised NFSv4 on FreeBSD

Question

I'm currently trying to set up an NFSv4 server on FreeBSD. I have extensive experience with doing this on other Unices (Solaris and Linux), but I'm fairly new to FreeBSD.

My goal is to achieve the following:

Files served from the FreeBSD system
The only security model should be krb5p
Clients are Linux (Ubuntu) and OSX

Currently, I have managed to set things up so that I need a valid TGT in order to access the file system. After an attempt to access those files, I can run klist on the client and I can see that the nfs/domainname principal has been retrieved. This suggests that the Kerberos part of the NFS mount is correct.

My problem is that all client accesses are still performed using the nobody user. I can see the permissions when I do ls -l. Even the user mapping works correctly, but unless nobody has permission to do anything with the files, I get a permission denied.

Here's an example interaction from the client (Ubuntu in this case, but the same thing happens from OSX). In this example, /export/shared/testshare is the shared directory from the FreeBSD server:

(I have changed the actual domain name to domain and the Kerberos realm name to REALM)

$ kinit
Password for elias@REALM:
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000_GBjtDP
Default principal: elias@REALM

Valid starting       Expires              Service principal
09/02/2013 09:40:47  10/02/2013 09:40:44  krbtgt/REALM@REALM
$ sudo mount -t nfs4 -osec=krb5p,vers=4 lion:/export/shared/testshare /mnt
$ ls -l /mnt
total 4
-rw-r--r-- 1 nobody nogroup   5 Feb  7 18:17 bar.txt
-rw------- 1 elias  nogroup   4 Feb  5 23:09 foo.txt
$ cat /mnt/bar.txt
blah
$ echo foo >>/mnt/bar.txt
bash: /mnt/bar.txt: Permission denied
$ cat /mnt/foo.txt
cat: /mnt/foo.txt: Permission denied
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000_GBjtDP
Default principal: elias@REALM

Valid starting       Expires              Service principal
09/02/2013 09:40:47  10/02/2013 09:40:44  krbtgt/REALM@REALM
09/02/2013 09:41:56  10/02/2013 09:40:44  nfs/lion.domain@REALM

Server configuration

I have had quite some problems in finding a comprehensive guide to setting up NFSv4 on FreeBSD. This is somewhat surprising in itself as I have found that information on how to do things in FreeBSD to be very good.

Here are the relevant lines in /etc/rc.conf:

rpcbind_enable="YES"
nfs_server_enable="YES"
nfsv4_server_enable="YES"
nfsuserd_enable="YES"
nfscbd_enable="YES"
mountd_enable="YES"
gssd_enable="YES"
rpc_lockd_enable="YES"
rpc_statd_enable="YES"
zfs_enable="YES"

Here is the content of /etc/exports:

/export/shared/testshare -sec=krb5p
V4: / -sec=krb5p

Another interesting aspect is that when I used tcpdump to record the NFS network traffic between the client and the server, I saw NFS3 packets together with the NFS4 packets. Both of these packet types contained encrypted data, so I still think Kerberos was used, but given the configuration above, I would have expected there to be nothing but NFS4 traffic.

igelkott · Answer 1 · 2013-02-15T23:49:38.577

0

Need to disable nfs3 with vfs.nfsd.server_min_nfsvers=4.
To avoid "nobody", NFSv4 client and server should be in the same ~~domain~~ realm.

edited Feb 15 '13 at 23:49

answered Feb 14 '13 at 23:20

igelkott

233
3
8

I did number 1 already, and it had no effect. As for number 2, are you referring to the DNS domain or the Kerberos realm? – Elias Mårtenson Feb 15 '13 at 05:38
Sorry, I meant "realm". Of course, it shouldn't be necessary but it's been easy when possible. A close second is add them to "Local-Realms" in the idmapd.conf. – igelkott Feb 15 '13 at 23:47
They are both in the same realm though (and the same domain). – Elias Mårtenson Feb 16 '13 at 16:30

score 0 · Answer 2 · answered Feb 16 '13 at 00:18

0

Simply put, there has to be some way to map usernames between the systems. Are you running idmapd on both server and client? Ldap?

At least as a test, try making specific mappings between names ... other than root, at least initially.

answered Feb 16 '13 at 00:18

igelkott

233
3
8

The mapping works. I get the correct user names displayed. However, the actual permissions that are being applied are for "nobody". – Elias Mårtenson Feb 16 '13 at 13:58
So, everything's working but it still fails. Sorry I couldn't really help. – igelkott Feb 16 '13 at 16:03

score 0 · Accepted Answer · answered Feb 21 '13 at 02:21

0

I solved the problem. After going through the code I found that the cause was a bug in the GSS library. The problem was caused by a buffer sent to getpwnam_r that was too small.

All the details can be found in the discussion on the mailing list

answered Feb 21 '13 at 02:21

Elias Mårtenson

309
1
4
12

Permissions are not taking effect with Kerberised NFSv4 on FreeBSD

3 Answers3