Cfrtjryk

I have NFS&Kerberos configured as described here: How do I configure a Kerberos NFS server on Red Hat Enterprise Linux 7

All diagnostics operations come fine, but when I try to mount my shares on the client side, I am getting following message:

mount.nfs4: access denied by server while mounting kdc.example.com:/var/backup

Both server&client's IPs are in both /etc/hosts (server & client machines), in a first place after the IP. My configuration is:

/etc/krb5.conf

[logging]

 default = FILE:/var/log/krb5libs.log

 kdc = FILE:/var/log/krb5kdc.log

 admin_server = FILE:/var/log/kadmind.log



[libdefaults]

 default_realm = EXAMPLE.COM

 dns_lookup_realm = false

 dns_lookup_kdc = false

 ticket_lifetime = 24h

 renew_lifetime = 7d

 forwardable = true



[realms]

 EXAMPLE.COM = {

  kdc = kdc.example.com

  admin_server = kdc.example.com

 }



[domain_realm]

 .example.com = EXAMPLE.COM

 example.com = EXAMPLE.COM

/etc/exports:

/var/backup client.example.com(rw,sync,no_wdelay,nohide,no_subtree_check,no_root_squash,sec=krb5)

/mnt/storage client.example.com(rw,sync,no_wdelay,nohide,no_subtree_check,no_root_squash,sec=krb5)

/var/kerberos/krb5kdc:

[kdcdefaults]

 kdc_ports = 88

 kdc_tcp_ports = 88



[realms]

 EXAMPLE.COM = {

    kdc_ports = 88

    admin_keytab = /etc/kadm5.keytab

    database_name = /var/kerberos/krb5kdc/principal

    acl_file = /var/kerberos/krb5kdc/kadm5.acl

    key_stash_file = /var/kerberos/krb5kdc/stash

    max_life = 10h 0m 0s

    max_renewable_life = 7d 0h 0m 0s

    master_key_type = des3-hmac-sha1

    supported_enctypes = arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3

    default_principal_flags = +preauth

}

krb5kdc & kadmin services are up and running on the server.

/etc/fstab on client:

#NFS area

kdc.example.com:/var/backup                              /mnt/backup                   nfs4     rsize=65536,wsize=65536,nolock,hard,sec=krb5

kdc.example.com:/mnt/storage                             /mnt/storage                  nfs4     rsize=65536,wsize=65536,nolock,hard,sec=krb5

When I do:

mount -vv -t nfs4 -o sec=krb5 kdc.example.com:/var/backup backup

I am getting message:

mount.nfs4: timeout set for Mon May 22 23:32:59 2017

mount.nfs4: trying text-based options 'sec=krb5,addr=95.85.33.75,clientaddr=192.168.0.2'

mount.nfs4: mount(2): Permission denied

mount.nfs4: access denied by server while mounting kdc.example.com:/var/backup

First remark - why clientaddr is 192.168.0.2 but not client.example.com which is set in the both /etc/hosts? Anyways, the same message appears when I add clientaddr=client.example.com into the -o option of mount.

Second message is in the /var/log/krb5kdc.log of server:

CLIENT_NOT_FOUND: NOUSER@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Client not found in Kerberos database

klist -k on server:

Keytab name: FILE:/etc/krb5.keytab

KVNO Principal

---- --------------------------------------------------------------------------

   3 host/kdc.example.com@EXAMPLE.COM

   3 host/kdc.example.com@EXAMPLE.COM

   3 host/kdc.example.com@EXAMPLE.COM

   3 nfs/kdc.example.com@EXAMPLE.COM

   3 nfs/kdc.example.com@EXAMPLE.COM

   3 nfs/kdc.example.com@EXAMPLE.COM

klist -k on client:

Keytab name: FILE:/etc/krb5.keytab

KVNO Principal

---- --------------------------------------------------------------------------

   2 host/client.example.com@EXAMPLE.COM

   2 host/client.example.com@EXAMPLE.COM

   2 host/client.example.com@EXAMPLE.COM

   2 nfs/client.example.com@EXAMPLE.COM

   2 nfs/client.example.com@EXAMPLE.COM

   2 nfs/client.example.com@EXAMPLE.COM

kadmin -p root/admin:

kadmin:  listprincs

K/M@EXAMPLE.COM

edrive@EXAMPLE.COM

host/client.example.com@EXAMPLE.COM

host/kdc.example.com@EXAMPLE.COM

kadmin/admin@EXAMPLE.COM

kadmin/changepw@EXAMPLE.COM

kadmin/example.com@EXAMPLE.COM

krbtgt/EXAMPLE.COM@EXAMPLE.COM

nfs/client.example.com@EXAMPLE.COM

nfs/kdc.example.com@EXAMPLE.COM

root/admin@EXAMPLE.COM

So, what the issue is? Why I cannot mount my NFS share?

I know it is somewhat old, but if you're still looking for this, I've faced similar problem and got a solution myself, you can get this at my answer to my problem "Fedora 26 NFS + Kerberos “Preauthentication failed” (mount lead to no permission)", I'm pretty sure RHEL can follow those settings

I got the same issue. According to this smal tutorial https://www.certdepot.net/rhel7-use-kerberos-control-access-nfs-network-shares/
you should enable nfs-secure-server service in server side and nfs-secure service in client side.
This should solve the problem.