Adding and configuring Access Appliance to the Kerberos realm
Kerberos authentication support on Access Appliance is available only if the Key Distribution Center (KDC) server is running on a standalone computer (in a non-AD (Active Directory) environment), and there is a single KDC server. Before Access Appliance can be used as a Kerberos client, the NFS service principal of Access Appliance has to be added to the KDC server. Use the Access Appliance cluster name (either the short name or the fully qualified domain name) in small letters as the host name when creating the NFS service principal.
For example, if access_ga_01 and access_ga_02 are two nodes in the Access Appliance cluster, then access_ga (or the fully qualified domain name access_ga.example.com) should be used for adding the NFS service principal. The Domain Name System (DNS) or /etc/hosts is then set up to resolve access_ga to all the virtual IPs of the Access Appliance cluster.
To configure the KDC server
- Create the NFS service principal on the KDC server using the kadmin.local command.
addprinc -randkey nfs/access_ga
- Create a
keytabfile for the NFS service principal on KDC.ktadd -k /etc/access.keytab nfs/access_ga
- Copy the created
keytabfile (/etc/access.keytab) to the Access Appliance console node. - Use the network krb standalone set command to set the Kerberos configuration on Access Appliance.
The network krb standalone set command takes the KDC server name, Kerberos realm, and the location of the
keytabthat is located on the Access Appliance console node. This command sets up the Kerberos configuration file/etc/krb5.confwith the KDC server name and realm on all the nodes of the Access Appliance cluster. The command then copies thekeytabfile to/etc/krb5.keytabon all the nodes of the Access Appliance cluster.Network> krb standalone set kdc_server TESTKDC.COM /home/support/krb5.keytab
The network krb standalone set command checks for the correct domain in the /etc/idmapd.conf file. If the domain is not set, the command gives a warning message saying that the DNS domain name needs to be set.
See Configuring Access Appliance for ID mapping for NFS version 4.
- Use the network krb standalone show command to show the Kerberos configuration.
- Use the network krb standalone unset command to reset the Kerberos configuration.
After the KDC server is configured, you can export the NFS shares with Kerberos authentication options.