Ubuntu
Kerberized nfs4 掛載錯誤：找不到連接到伺服器的憑據
我的客戶端/伺服器都在執行 ubuntu 14.04，並且 kerberos 使用者身份驗證按預期工作。正常的 nfs4 安裝也可以正常工作。所有機器都在執行 heimdal 庫。
不過，我無法讓 kerberized nfs4 正常工作。
安裝共享時，我得到以下日誌：
客戶：
# mount -t nfs4 -o sec=krb5 server:/ /mnt/tmp -vvvvvv mount: fstab path: "/etc/fstab" mount: mtab path: "/etc/mtab" mount: lock path: "/etc/mtab~" mount: temp path: "/etc/mtab.tmp" mount: UID: 0 mount: eUID: 0 mount: spec: "SERVER:/" mount: node: "/mnt/tmp" mount: types: "nfs4" mount: opts: "sec=krb5" mount: external mount: argv[0] = "/sbin/mount.nfs4" mount: external mount: argv[1] = "SERVER:/" mount: external mount: argv[2] = "/mnt/tmp" mount: external mount: argv[3] = "-v" mount: external mount: argv[4] = "-o" mount: external mount: argv[5] = "rw,sec=krb5" mount.nfs4: timeout set for Sun Jun 15 01:10:30 2014 mount.nfs4: trying text-based options 'sec=krb5,addr=XXX.XXX.XXX.52,clientaddr=XXX.XXX.XXX.17' mount.nfs4: mount(2): Permission denied mount.nfs4: access denied by server while mounting SERVER:/rpc.gssd：
Jun 15 01:31:15 client rpc.gssd[24146]: destroying client /run/rpc_pipefs/nfsd4_cb/clnt4 Jun 15 01:31:15 client rpc.gssd[24146]: destroying client /run/rpc_pipefs/nfsd4_cb/clnt3 Jun 15 01:31:15 client rpc.gssd[24146]: destroying client /run/rpc_pipefs/nfsd4_cb/clnt2 Jun 15 01:31:15 client rpc.gssd[24146]: destroying client /run/rpc_pipefs/nfsd4_cb/clnt0 Jun 15 01:31:15 client rpc.gssd[24146]: handling gssd upcall (/run/rpc_pipefs/nfs/clntf) Jun 15 01:31:15 client rpc.gssd[24146]: handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' Jun 15 01:31:15 client rpc.gssd[24146]: handling krb5 upcall (/run/rpc_pipefs/nfs/clntf) Jun 15 01:31:15 client rpc.gssd[24146]: process_krb5_upcall: service is '<null>' Jun 15 01:31:15 client rpc.gssd[24146]: Full hostname for 'server.example.com' is 'server.example.com' Jun 15 01:31:15 client rpc.gssd[24146]: Full hostname for 'client.example.com' is 'CLIENT.example.com' Jun 15 01:31:15 client rpc.gssd[24146]: No key table entry found for client$@EXAMPLE.COM while getting keytab entry for 'DEVEL01$@' Jun 15 01:31:15 client rpc.gssd[24146]: No key table entry found for root/client.example.com@EXAMPLE.COM while getting keytab entry for 'root/CLIENT.example.com@' Jun 15 01:31:15 client rpc.gssd[24146]: Success getting keytab entry for 'nfs/client.example.com@' Jun 15 01:31:15 client rpc.gssd[24146]: WARNING: Cryptosystem internal error while getting initial ticket for principal 'nfs/CLIENT.example.com@EXAMPLE.COM' using keytab 'FILE:/etc/krb5.keytab' Jun 15 01:31:15 client rpc.gssd[24146]: ERROR: No credentials found for connection to server server.example.com Jun 15 01:31:15 client rpc.gssd[24146]: doing error downcall Jun 15 01:31:15 client rpc.gssd[24146]: destroying client /run/rpc_pipefs/nfs/clnt55 Jun 15 01:31:15 client rpc.gssd[24146]: destroying client /run/rpc_pipefs/nfsd4_cb/clnt4 Jun 15 01:31:15 client rpc.gssd[24146]: destroying client /run/rpc_pipefs/nfsd4_cb/clnt3 Jun 15 01:31:15 client rpc.gssd[24146]: destroying client /run/rpc_pipefs/nfsd4_cb/clnt2 Jun 15 01:31:15 client rpc.gssd[24146]: destroying client /run/rpc_pipefs/nfsd4_cb/clnt0客戶端密鑰表：
Vno Type Principal Aliases 1 aes256-cts-hmac-sha1-96 nfs/client.example.com@EXAMPLE.COM 1 des3-cbc-sha1 nfs/client.example.com@EXAMPLE.COM 1 arcfour-hmac-md5 nfs/client.example.com@EXAMPLE.COM伺服器：
KDC:
Jun 15 01:44:34 server kdc[13705]: AS-REQ nfs/client.example.com@EXAMPLE.COM from IPv4:XXX.XXX.XXX.17 for krbtgt/EXAMPLE.COM@EXAMPLE.COM Jun 15 01:44:34 server kdc[13705]: Client sent patypes: REQ-ENC-PA-REP Jun 15 01:44:34 server kdc[13705]: Looking for PK-INIT(ietf) pa-data -- nfs/client.example.com@EXAMPLE.COM Jun 15 01:44:34 server kdc[13705]: Looking for PK-INIT(win2k) pa-data -- nfs/client.example.com@EXAMPLE.COM Jun 15 01:44:34 server kdc[13705]: Looking for ENC-TS pa-data -- nfs/client.example.com@EXAMPLE.COM Jun 15 01:44:34 server kdc[13705]: Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ Jun 15 01:44:34 server kdc[13705]: sending 292 bytes to IPv4:XXX.XXX.XXX.17關於這裡有什麼問題的任何指示？
6 月 15 日 01:31:15 客戶端 rpc.gssd
$$ 24146 $$: 警告: 使用 keytab ‘FILE:/etc/krb5.keytab’ 獲取主體’nfs/CLIENT.example.com@EXAMPLE.COM’ 的初始票證時出現密碼系統內部錯誤
您可以使用 kinit 使用此命令獲取 tgt 嗎（假設 mit kinit ）
kinit -k -t /etc/krb5.keytab nfs/CLIENT.example.com@EXAMPLE.COM
我猜您已經對此進行了消毒，但是在 kerberos 主體中大小寫很重要。錯誤消息中的主體與密鑰表中的主體不同。你用 DNS 做有趣的事情嗎（比如返回大寫的 DNS 主機名）？
查看 KDC 消息，我猜您在密鑰表中沒有正確的 nfs/client.example.com 密鑰。