Mounting an NFS share with Kerberos security from the NFS client
This section explains how the NFS client does an NFS mount with the Kerberos mount options. This procedure assumes that the NFS service principal of the NFS client is added to the KDC server, and the keytab is copied at the appropriate location on the client.
The steps may differ depending on the operating system and version of the client. On a Red Hat Enterprise Linux (RHEL) client, Kerberos can be configured as follows.
To mount the NFS client with the Kerberos mount options
- Create the NFS service principal for the client on the KDC server and copy it to the client system at
/etc/krb5.keytab. - Configure the
/etc/krb5.conffile with the KDC details. - Enable SECURE_NFS=yes in the
/etc/sysconfig/nfsfile. - Start the rpcgssd service.
# service rpcgssd start
- Keep the clocks of the KDC server, the Access Appliance server, and the NFS client in sync.
A maximum of a five-minute variation is accepted, or otherwise the Kerberos NFS mount fails.
[root@krb-client]# mount -o vers=4,sec=krb5 10.209.107.24:/vx/fs2/share1 /mnt/share1
Make sure that the virtual IP that is used for mounting can use reverse name lookup to the Access Appliance cluster name. For example, if access_ga is the cluster name, then in the above example, access_ga should look up to 10.209.107.24 and vice versa. If the IP 10.209.107.24 can be looked up by multiple host names, make sure that the entry access_ga is first in the reverse lookup.
- Ensure that the user accessing the NFS share:
Is already added on the KDC server.
Is a valid user on the Access Appliance cluster.
Is either the owner of the share directory or has the necessary permissions to access the NFS share directory.
Use kinit to get the ticket granting ticket from the KDC server on the NFS client.
[root@krb-client]# su - sfuuser2
[sfuuser2@krb-client ~]$ kinit Password for sfuuser2@TESTKDC.COM: [sfuuser2@krb-client ~]$ cd /mnt/share1 [sfuuser2@krb-client share1]$ touch test.txt [sfuuser2@krb-client share1]$ [sfuuser2@krb-client share1]$ ls -al total 4 drwxrwxrwx 2 root root 96 May 14 16:03 . drwxr-xr-x. 17 root root 4096 May 7 19:41 .. -rw-r--r-- 1 sfuuser2 sfugroup1 0 May 14 16:03 test.txt