Alright, I am close to giving up on this but here is to one more attempt. I have more questions than answers and any help would be greatly appreciated.
The operating system on the server is Debian Stretch, on the client it is Debian Sid. I have a NFSv4 with Kerberos server (both servers are on the same physical machine) which exports /home/User1. The /etc/exports
is
/home/User1 gss/krb5(rw,insecure,sync,wdelay,no_subtree_check,no_root_squash)
I have idmap enabled in /etc/default/nfs-common and the idmapd.conf
is
[General]
Verbosity = 5
Pipefs-Directory = /run/rpc_pipefs
Domain = MyDomain
[Mapping]
Nobody-User = nobody
Nobody-Group = nogroup
Now, the client has a User2 that is the same individual as User1. However, the strings that are User1 and User2 have to be different for certain reasons. The idmapd.conf
file on the client is exactly the same. When I mount Server:/home/User1
from client as root, the Kerberos server issues a service ticket based on machine authentication (/tmp/krb5ccmachine) and I am able to mount /home/User1. However, as you might have already guessed, the ownership of the mounted directory is all messed up. For one, the no_root_squash option is completely ignored, so even root on the client cannot write to the mounted directory. User2 cannot even cd into it.
Now, from what I understand, the NFS server doesn't know that root on the client is root (why? shouldn't root@MyDomain
translate to root on the server?) From what I gathered from similar questions on this site, the following changes to the server's idmapd.conf
fix this issue:
[Translate]
GSS-Methods = static
[Static]
nfs/client@MYREALM = root #principal used to authenticate client
Annoyingly, the root now has full privileges to the mounted directory even after reverting the changes to idmapd.conf and restarting the nfs server. Where is this persistence coming from?
To my main questions: how can I mount /home/User1 so that User2 is the owner of the mounted directory, and so that any files created by User2 will appear as owned by User1 on the server? In NFSv3 it seems this was straightforward since ownership was determined by uid:gid. Is this even possible with NFSv4?