☰

NFS + Kerberos：安装时服务器拒绝访问

tag-icon • tag-icon nfs kerberos
NFS + Kerberos：安装时服务器拒绝访问

我按照此处所述配置了 NFS&Kerberos：如何在 Red Hat Enterprise Linux 7 上配置 Kerberos NFS 服务器

所有诊断操作都很好，但是当我尝试在客户端安装我的共享时，我收到以下消息：

mount.nfs4: access denied by server while mounting kdc.example.com:/var/backup

服务器和客户端的 IP 都位于 /etc/hosts（服务器和客户端计算机）中，位于 IP 之后的第一个位置。我的配置是：

/etc/krb5.conf

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 EXAMPLE.COM = {
  kdc = kdc.example.com
  admin_server = kdc.example.com
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM

/etc/导出：

/var/backup client.example.com(rw,sync,no_wdelay,nohide,no_subtree_check,no_root_squash,sec=krb5)
/mnt/storage client.example.com(rw,sync,no_wdelay,nohide,no_subtree_check,no_root_squash,sec=krb5)

/var/kerberos/krb5kdc：

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 EXAMPLE.COM = {
    kdc_ports = 88
    admin_keytab = /etc/kadm5.keytab
    database_name = /var/kerberos/krb5kdc/principal
    acl_file = /var/kerberos/krb5kdc/kadm5.acl
    key_stash_file = /var/kerberos/krb5kdc/stash
    max_life = 10h 0m 0s
    max_renewable_life = 7d 0h 0m 0s
    master_key_type = des3-hmac-sha1
    supported_enctypes = arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3
    default_principal_flags = +preauth
}

krb5kdc 和 kadmin 服务已在服务器上启动并运行。

客户端上的 /etc/fstab：

#NFS area
kdc.example.com:/var/backup                              /mnt/backup                   nfs4     rsize=65536,wsize=65536,nolock,hard,sec=krb5
kdc.example.com:/mnt/storage                             /mnt/storage                  nfs4     rsize=65536,wsize=65536,nolock,hard,sec=krb5

当我做：

mount -vv -t nfs4 -o sec=krb5 kdc.example.com:/var/backup backup

我收到消息：

mount.nfs4: timeout set for Mon May 22 23:32:59 2017
mount.nfs4: trying text-based options 'sec=krb5,addr=95.85.33.75,clientaddr=192.168.0.2'
mount.nfs4: mount(2): Permission denied
mount.nfs4: access denied by server while mounting kdc.example.com:/var/backup

第一个评论 - 为什么 clientaddr 是 192.168.0.2 而不是在 /etc/hosts 中设置的 client.example.com ？无论如何，当我将 clientaddr=client.example.com 添加到 mount 的 -o 选项中时，会出现相同的消息。

第二条消息位于服务器的 /var/log/krb5kdc.log 中：

CLIENT_NOT_FOUND: [email protected] for krbtgt/[email protected], Client not found in Kerberos database

服务器上的 klist -k：

Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 host/[email protected]
   3 host/[email protected]
   3 host/[email protected]
   3 nfs/[email protected]
   3 nfs/[email protected]
   3 nfs/[email protected]

客户端上的 klist -k：

Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 host/[email protected]
   2 host/[email protected]
   2 host/[email protected]
   2 nfs/[email protected]
   2 nfs/[email protected]
   2 nfs/[email protected]

kadmin -p 根/管理员：

kadmin:  listprincs
K/[email protected]
[email protected]
host/[email protected]
host/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
krbtgt/[email protected]
nfs/[email protected]
nfs/[email protected]
root/[email protected]

那么，问题是什么？为什么我无法挂载 NFS 共享？

答案1

我遇到了同样的问题。根据这个小教程https://www.certdepot.net/rhel7-use-kerberos-control-access-nfs-network-shares/ 您应该在服务器端启用 nfs-secure-server 服务，在客户端启用 nfs-secure 服务。这应该可以解决问题。

答案2

我昨天遇到了同样的问题，这似乎是由于 KDC 上缺少主体并且 rpc-gssd.service 在客户端上停止而发生的。

在 KDC 服务器上，应启动 tail -f /var/log/krb5kdc.log，并在尝试从客户端挂载 NFS 共享时在日志中显示缺少主体（如果有）。

[vagrant@desktop1 ~]$ sudo mount -o sec=krb5 server1:/knfs /knfs -v
mount.nfs: timeout set for Sun Feb 24 09:44:35 2019
mount.nfs: trying text-based options 'sec=krb5,vers=4.1,addr=192.168.121.163,clientaddr=192.168.121.26'
mount.nfs: mount(2): Permission denied
mount.nfs: trying text-based options 'sec=krb5,vers=4.0,addr=192.168.121.163,clientaddr=192.168.121.26'
mount.nfs: mount(2): Permission denied
mount.nfs: trying text-based options 'sec=krb5,addr=192.168.121.163'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: portmap query failed: RPC: Remote system error - No route to host
^C
[vagrant@desktop1 ~]$

在日志输出中已识别出丢失的主体：

[vagrant@server1 ~]$ sudo tail -f /var/log/krb5kdc.log 
Feb 24 09:42:35 server1 krb5kdc[2870](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 192.168.121.26: LOOKING_UP_SERVER: authtime 0,  nfs/[email protected] for nfs/[email protected], Server not found in Kerberos database
Feb 24 09:42:35 server1 krb5kdc[2870](info): TGS_REQ (4 etypes {18 17 16 23}) 192.168.121.26: LOOKING_UP_SERVER: authtime 0,  nfs/[email protected] for nfs/[email protected], Server not found in Kerberos database
Feb 24 09:42:35 server1 krb5kdc[2870](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 192.168.121.26: LOOKING_UP_SERVER: authtime 0,  nfs/[email protected] for nfs/[email protected], Server not found in Kerberos database
Feb 24 09:42:35 server1 krb5kdc[2870](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 192.168.121.26: LOOKING_UP_SERVER: authtime 0,  nfs/[email protected] for nfs/[email protected], Server not found in Kerberos database

需要在 KDC 上添加缺少的主体，并将客户端密钥导出到客户端{/etc/krb5.keytab}。

sudo kadmin.local -q "ktadd nfs/kerberos.example.com"
sudo kadmin.local -q "ktadd -k /tmp/krb5.keytab nfs/desktop1.example.com"

客户端的密钥表：

[vagrant@desktop1 ~]$ sudo klist -ek
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 nfs/[email protected] (aes256-cts-hmac-sha1-96) 
   3 nfs/[email protected] (aes128-cts-hmac-sha1-96) 
   3 nfs/[email protected] (des3-cbc-sha1) 
   3 nfs/[email protected] (arcfour-hmac) 
   3 nfs/[email protected] (camellia256-cts-cmac) 
   3 nfs/[email protected] (camellia128-cts-cmac) 
   3 nfs/[email protected] (des-hmac-sha1) 
   3 nfs/[email protected] (des-cbc-md5) 
[vagrant@desktop1 ~]$

被拒绝的权限不应再出现，但对于错误的参数应出现另一个警告。

[vagrant@desktop1 ~]$ sudo mount -o sec=krb5 server1:/knfs /knfs -v
mount.nfs: timeout set for Sun Feb 24 09:07:32 2019
mount.nfs: trying text-based options 'sec=krb5,vers=4.1,addr=192.168.121.54,clientaddr=192.168.121.195'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,vers=4.0,addr=192.168.121.54,clientaddr=192.168.121.195'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,addr=192.168.121.54'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: portmap query failed: RPC: Remote system error - No route to host
mount.nfs: trying text-based options 'sec=krb5,vers=4.0,addr=192.168.121.54,clientaddr=192.168.121.195'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,addr=192.168.121.54'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: portmap query failed: RPC: Remote system error - No route to host
mount.nfs: trying text-based options 'sec=krb5,vers=4.0,addr=192.168.121.54,clientaddr=192.168.121.195'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,addr=192.168.121.54'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: portmap query failed: RPC: Remote system error - No route to host
^C
[vagrant@desktop1 ~]$

启动服务rpc-gssd.service后，错误消失，NFS共享已正确挂载：

[vagrant@desktop1 ~]$ sudo systemctl start rpc-gssd.service 
[vagrant@desktop1 ~]$ sudo mount -o sec=krb5 server1:/knfs /knfs -v mount.nfs: 
timeout set for Sun Feb 24 09:07:47 2019 mount.nfs: trying text-based options 'sec=krb5,vers=4.1,addr=192.168.121.54,clientaddr=192.168.121.195' 
[vagrant@desktop1 ~]$

门票如下：

[vagrant@desktop1 ~]$ sudo klist -e
Ticket cache: KEYRING:persistent:0:krb_ccache_kfAgj83
Default principal: nfs/[email protected]

Valid starting     Expires            Service principal
01/01/70 00:00:00  01/01/70 00:00:00  Encrypted/Credentials/v1@X-GSSPROXY:
[vagrant@desktop1 ~]$

答案3

我知道它有点旧，但如果您仍在寻找这个，我也遇到过类似的问题并自己找到了解决方案，您可以在我对问题的回答中找到它“Fedora 26 NFS + Kerberos“预身份验证失败”（挂载导致无权限）”，我很确定 RHEL 可以遵循这些设置

答案4

在 Kerberos 由 FreeIPA 管理的环境中，我在 RHEL 7 服务器上遇到了类似的问题。一些设置：

此环境是 AD / FreeIPA 环境，其中 FreeIPA（服务器idm.nix.example.com）对 Windows DC 具有双向信任dc.example.com。 Linux 和 Windows 服务器都位于同一子网中172.16.0.0/24。因此，由于首先创建了 MSAD，因此在配置 FreeIPA 时，不会为nix.example.com主机动态创建反向区域。这是一个已知问题，可通过以下方式跟踪这个 BugZilla。

运行 mount 命令时，出现以下错误。 NFS服务器上没有相应的错误：

[root@idm1 ~]# mount -v -o sec=krb5:krb5i:krb5p -t nfs 172.16.0.9:/share /mnt
mount.nfs: timeout set for Tue Sep  8 21:58:01 2020
mount.nfs: trying text-based options 'sec=krb5:krb5i:krb5p,vers=4.1,addr=172.16.0.9,clientaddr=172.16.0.6'
mount.nfs: mount(2): Permission denied
mount.nfs: trying text-based options 'sec=krb5:krb5i:krb5p,vers=4.0,addr=172.16.0.9,clientaddr=172.16.0.6'
mount.nfs: mount(2): Permission denied
mount.nfs: trying text-based options 'sec=krb5:krb5i:krb5p,addr=172.16.0.9'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: trying 172.16.0.9 prog 100003 vers 3 prot TCP port 2049
mount.nfs: prog 100005, trying vers=3, prot=17
mount.nfs: trying 172.16.0.9 prog 100005 vers 3 prot UDP port 20048
mount.nfs: mount(2): Permission denied
mount.nfs: access denied by server while mounting 172.16.0.9:/share

通过更改，我碰巧这样做systemctl status rpc-gssd.service并收到以下错误：

[root@idm1 ~]# systemctl status rpc-gssd.service
● rpc-gssd.service - RPC security service for NFS client and server
   Loaded: loaded (/usr/lib/systemd/system/rpc-gssd.service; static; vendor preset: disabled)
   Active: active (running) since Tue 2020-09-08 15:32:28 EDT; 6h ago
  Process: 28217 ExecStart=/usr/sbin/rpc.gssd $GSSDARGS (code=exited, status=0/SUCCESS)
 Main PID: 28218 (rpc.gssd)
   CGroup: /system.slice/rpc-gssd.service
           └─28218 /usr/sbin/rpc.gssd

Sep 08 21:50:39 idm1.nix.example.com rpc.gssd[28218]: **ERROR: unable to resolve 172.16.0.9 to hostname: Name or service not known**
Sep 08 21:50:39 idm1.nix.example.com rpc.gssd[28218]: **ERROR: failed to parse nfs/clntf3/info**

由于此NIX环境没有动态创建 PTR，因此您必须添加 NFS 服务器/etc/hosts或手动创建相关 PTR 记录。您可以通过将 NFS 服务器添加到以下位置来验证是否修复了问题/etc/hosts：

[root@idm1 ~]# echo "172.16.0.9 nfs.nix.example.com" >> /etc/hosts
[root@idm1 ~]# ls /mnt
hgfs
[root@idm1 ~]# mount -v -o sec=krb5:krb5i:krb5p -t nfs 172.16.0.9:/share /mnt
mount.nfs: timeout set for Tue Sep  8 22:01:00 2020
mount.nfs: trying text-based options 'sec=krb5:krb5i:krb5p,vers=4.1,addr=172.16.0.9,clientaddr=172.16.0.6'
[root@idm1 ~]# ls /mnt
idm1  idm1-2

长话短说：在 MSAD <-> IPA 信任环境中，请确保某些服务正在为 NFS 等服务提供 PTR 记录，因为它们不是动态创建的。

相关内容