service on nfs with sec=krb5i

Question

I'm trying to install nextcloud on an ArchLinuxARM box and would like to store uploaded data on an NFS server (debian testing). NFS server uses sec=krb5i to export shares.

I have SSSD running and NFS works smoothly for ordinary users.

However, I fail to make this work for user http.

I'm testing with

sudo -u http ls /mount/http-folder

Next, I tried to export http's keys to a keytab, but sudo -u http KRB5_CLIENT_KTNAME=/etc/httpd/conf/krb5.keytab ls /mount/http-folder has same problem.

Update(2 - solved!):

The application needs to be aware of kerberos and honor KRB5_CLIENT_KTNAME.

Or better, when the client keytab is in its default location (as pointed out by Piotr P. Karwasz, that could be identified with krb5-config --defcktname) it will be picked up by rpc.gssd automatically.

[root]> su -l http -s /usr/sbin/bash
[http]> ls /mount/http-folder
ls: cannot open directory '/mount/http-folder': Stale file handle
[http]> krb5-config --defcktname
FILE:/var/lib/krb5/user/%{euid}/client.keytab
[http]> export KRB5_CLIENT_KTNAME=/var/lib/krb5/user/http/client.keytab 
[http]> ls /mount/http-folder
ls: cannot access '/mount/http-folder': Permission denied

# note the difference (1)

[http]> $ kinit -t $KRB5_CLIENT_KTNAME http
keytab specified, forcing -k
[http]> ls /mount/http-folder
this_is_www-data
[http]> exit

# solution:

[root]> mv /var/lib/krb5/user/http /var/lib/krb5/user/`id -u http`
[root]> su -l http -s /usr/sbin/bash
[http]> kdestroy  # (2)
[http]> ls /mount/http-folder
this_is_www-data

(1) not sure what causes this - according to kerberos docs it should use the first principal it finds in the client keytab file - the client keytab contains only the desired princial, so ... ? As Piotr P. Karwasz correctly points out, %{euid] is the numeric id, not the usename (bummer!), so client keytab is not in default location!

(2) make sure ticket cache is empty

So, problem solved. Thanks, Piotr!

Try the default location of client keytabs: `krb5-config --defcktname`. — Piotr P. Karwasz, Dec 07 '19 at 22:36
Thanks for pointing that out. Updated question with more info. — Snakebite, Dec 08 '19 at 19:37

score 0 · Accepted Answer · answered Dec 08 '19 at 19:54

When a process accesses you NFS mount, the kernel makes an upcall to rpc.gssd to establish the credentials. I didn't explore the upcall mechanism further, but I believe that rpc.gssd doesn't have access to the KRB5_CLIENT_KTNAME variable or just ignores it and uses the default location.

The file /var/lib/krb5/user/http/client.keytab is not the default location on your system. Try replacing http with the numeric uid of user http:

getent passwd http | cut -d : -f 3

service on nfs with sec=krb5i

1 Answers1