Configuring Kerberos for NFS 4.1 access ( Ubuntu)

  • Article

This blog talks about configuring Kerberos on Ubuntu for NFS access. NFS is hosted on a 2 node cluster environment.

Environment:

  1. Windows 2012 as DC and cluster node
  2. Ubuntu as NFS client

Cluster node:

  1. Ran the command on the cluster node to check the SPN for NFS

 

C:\> setspn –l node1

Registered ServicePrincipalNames for CN=node1.CN=Computers,DC=contoso,DC=local:

nfs/node1

nfs/node1.contoso.local

WSMAN/node1

WSMAN/node1. contoso.local 

RestrictedkrbHost/node1

HOST/node1

RestrictedkrbHost/node1. contoso.local

HOST/node1. contoso.local

Windows 2012 DC:

  1. On the DC, created a container and a user called linuxclientuser
  2. Disabled Pre-Auth for the user and Enable AES 256 Bit encryption option 
  3. Register the spn for the Ubuntu (NFS client) by running the command below. The command needs to be run both for the host name and the FQDN of the Ubuntu client.

 

4. Ran the ktpass command to create the keytab

 

 

Note: ubuntu2.contoso.local is the linux machine host name. It is not joined to the windows domain rather only has the host (A) record in the DNS.

Note: In order to make sure AES works for the TGT, we need to raise the domain functional level to 2008 or later.

Note: We had to make a reverse lookup zone and registered the NFS Server PTR record there as linux client was constantly querying for this.

 

5. Exported the keytab file to Ubuntu.

Ubuntu:

 

1. Ran the following command on Ubuntu:

2. Referred https://help.ubuntu.com/community/NFSv4Howto for NFS v4.1

3. We need to install the below modules:

 

    • apt-get install libpam-krb5

 

4. Run the following command

  • modprobe rpcsec_gss_krb5

 

 5. Add rpcsec_gss_krb5 to /etc/modules to have it loaded automatically ==> This at times get loaded automatically 

 

6. Edit the file, /etc/default/nfs-common :

  • NEED_GSSD=yes è ( this needs to be added)

7. Start the following gssd service:

  • sudo service gssd start

  • gssd stop/post-stop, process 3061

  • sudo service gssd start

 

8. Run the command

  • kinit –k nfs/linuxclient.contoso.com ==> to make sure this has been configured properly

9. Try mounting the share using NFS v4.1 and Kerberos

  • mount –o sec=krb5,vers=4,minorversion=1 windowsnfsserver:/share /mnt/share

  • Alternativelly, you can make the changes below on the /etc/fstab file