I'm setting up NFS with Kerberos and following various guides, like NFSv4 with Kerberos on Ubuntu Wiki and How To Use Kerberos to Control Access to NFS Network Shares, amongst others. All guides follow the same basic pattern:
- Set up a KDC
- Create a key-based principal for
nfs/nfs-server
and make sure that these keys are in the/etc/krb5.keytab
file of the NFS server - Create a key-based principal for
nfs/nfs-client
and make sure that these keys are in the/etc/krb5.keytab
file of the NFS client
The next step is what's confusing me. Once /etc/exports
on the NFS server is changed to some variation of...
/nfs/some-dir [ip-address](rw,sec=krb5p,all_squash,sync)
... how does the NFS server know which Kerberos principal has been assigned to itself? Even more basic - how does the NFS server know which Kerberos realm is has been added to? Further, how does the NFS server know which Kerberos principals to allow access to? There could be a number of Kerberos users/principals in the realm and not all should be allowed access to a particular NFS export.
In a similar vein, once the following is executed on the NFS client...
mount -t nfs4 -o sec=krb5p [ip-address]:/nfs/some-dir /mnt/some-dir
...how does the NFS client know which Kerberos principal/key to use when talking to the NFS server?
Is there some implicit magic going on in the /etc/krb5.keytab
and /etc/krb5.conf
files?