I am trying to get NFS4 + Kerberos to work on Debian Squeeze.
I have 3 test machines: nfsserver, nfsclient, nfskerberos
What I've got is:
root@nfsclient:~# mount -v -t nfs4 -o sec=krb5 nfsserver.mydomain.com:/export /import
mount.nfs4: timeout set for Fri Apr 5 10:15:33 2013
mount.nfs4: trying text-based options 'sec=krb5,addr=10.10.16.207,clientaddr=10.10.16.208'
mount.nfs4: mount(2): Permission denied
mount.nfs4: access denied by server while mounting nfsserver.mydomain.com:/export
I think the problem is at nfsclient<->nfskerberos communication. After sniffing network traffic between these systems I see messages like:
error_code: KRB5KDC_ERR_ETYPE_NOSUPP (14)
[...]
e-text: BAD_ENCRYPTION_TYPE
[Only nfsclient communicates with nfskerberos. There is no traffic from nfsserver at nfskerberos.]
kinit -k on nfsclient works OK, though:
root@nfsclient:~# kinit -k nfs/nfsclient.mydomain.com
root@nfsclient:~# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: nfs/nfsclient.mydomain.com@MYDOMAIN.COM
Valid starting Expires Service principal
04/05/13 11:44:55 04/05/13 21:44:55 krbtgt/MYDOMAIN.COM@MYDOMAIN.COM
renew until 04/06/13 11:44:55
But kinit does AS-REQ and mount request does TGS-REQ.
I tried many kinds of encryption types like:
- des-cbc-crc:normal
- aes256-cts-hmac-sha1-96:normal (this one works with kinit)
- des3-hmac-sha1:normal
- ...
On nfskerberos, in kdc configuration I have:
[kdcdefaults]
kdc_ports = 750,88
[realms]
MYDOMAIN.COM = {
database_name = /var/lib/krb5kdc/principal
admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
acl_file = /etc/krb5kdc/kadm5.acl
key_stash_file = /etc/krb5kdc/stash
kdc_ports = 750,88
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des3-hmac-sha1
supported_enctypes = aes256-cts:normal arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3
default_principal_flags = +preauth
}
Conversation between nfsclient and nfskerberos:
No. Time Source Destination Protocol Length Info
7 11.128679 10.10.16.208 10.10.16.209 KRB5 808 TGS-REQ
[ cut lower level protocols data ]
Kerberos TGS-REQ
Pvno: 5
MSG Type: TGS-REQ (12)
padata: PA-TGS-REQ
Type: PA-TGS-REQ (1)
Value: 6e82025630820252a003020105a10302010ea20703050000... AP-REQ
Pvno: 5
MSG Type: AP-REQ (14)
Padding: 0
APOptions: 00000000
0... .... .... .... .... .... .... .... = reserved: RESERVED bit off
.0.. .... .... .... .... .... .... .... = Use Session Key: Do NOT use the session key to encrypt the ticket
..0. .... .... .... .... .... .... .... = Mutual required: Mutual authentication is NOT required
Ticket
Tkt-vno: 5
Realm: MYDOMAIN.COM
Server Name (Service and Instance): krbtgt/MYDOMAIN.COM
Name-type: Service and Instance (2)
Name: krbtgt
Name: MYDOMAIN.COM
enc-part aes256-cts-hmac-sha1-96
Encryption type: aes256-cts-hmac-sha1-96 (18)
Kvno: 1
enc-part: c03dbd56915263874441e07531f689fa16ed7593a8118741...
Authenticator aes256-cts-hmac-sha1-96
Encryption type: aes256-cts-hmac-sha1-96 (18)
Authenticator data: bae42b08eb935796e3dd31d9d34f5a4cc419b6594be7a8ed...
KDC_REQ_BODY
Padding: 0
KDCOptions: 50810000 (Forwardable, Proxiable, Renewable, Canonicalize)
.1.. .... .... .... .... .... .... .... = Forwardable: FORWARDABLE tickets are allowed/requested
..0. .... .... .... .... .... .... .... = Forwarded: This is NOT a forwarded ticket
...1 .... .... .... .... .... .... .... = Proxiable: PROXIABLE tickets are allowed/requested
.... 0... .... .... .... .... .... .... = Proxy: This ticket has NOT been proxied
.... .0.. .... .... .... .... .... .... = Allow Postdate: We do NOT allow the ticket to be postdated
.... ..0. .... .... .... .... .... .... = Postdated: This ticket is NOT postdated
.... .... 1... .... .... .... .... .... = Renewable: This ticket is RENEWABLE
.... .... ...0 .... .... .... .... .... = Opt HW Auth: False
.... .... .... ..0. .... .... .... .... = Constrained Delegation: This is a normal request (no constrained delegation)
.... .... .... ...1 .... .... .... .... = Canonicalize: This is a request for a CANONICALIZED ticket
.... .... .... .... .... .... ..0. .... = Disable Transited Check: Transited checking is NOT disabled
.... .... .... .... .... .... ...0 .... = Renewable OK: We do NOT accept renewed tickets
.... .... .... .... .... .... .... 0... = Enc-Tkt-in-Skey: Do NOT encrypt the tkt inside the skey
.... .... .... .... .... .... .... ..0. = Renew: This is NOT a request to renew a ticket
.... .... .... .... .... .... .... ...0 = Validate: This is NOT a request to validate a postdated ticket
Realm: MYDOMAIN.COM
Server Name (Service and Host): nfs/nfsserver.mydomain.com
Name-type: Service and Host (3)
Name: nfs
Name: nfsserver.mydomain.com
till: 2013-04-05 17:58:28 (UTC)
Nonce: 1365155889
Encryption Types: aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 rc4-hmac des-cbc-crc des-cbc-md5 des-cbc-md4
Encryption type: aes256-cts-hmac-sha1-96 (18)
Encryption type: aes128-cts-hmac-sha1-96 (17)
Encryption type: des3-cbc-sha1 (16)
Encryption type: rc4-hmac (23)
Encryption type: des-cbc-crc (1)
Encryption type: des-cbc-md5 (3)
Encryption type: des-cbc-md4 (2)
No. Time Source Destination Protocol Length Info
8 11.130891 10.10.16.209 10.10.16.208 KRB5 244 KRB Error: KRB5KDC_ERR_ETYPE_NOSUPP
[ cut lower level protocols data ]
Kerberos KRB-ERROR
Pvno: 5
MSG Type: KRB-ERROR (30)
ctime: 2013-04-05 09:58:09 (UTC)
stime: 2013-04-05 09:58:09 (UTC)
susec: 588499
error_code: KRB5KDC_ERR_ETYPE_NOSUPP (14)
Client Realm: MYDOMAIN.COM
Client Name (Principal): nfs/nfsclient.mydomain.com
Name-type: Principal (1)
Name: nfs
Name: nfsclient.mydomain.com
Realm: MYDOMAIN.COM
Server Name (Service and Host): nfs/nfsserver.mydomain.com
Name-type: Service and Host (3)
Name: nfs
Name: nfsserver.mydomain.com
e-text: BAD_ENCRYPTION_TYPE
