[Samba] Urgent... winbind and keytab file creation

[Oliver Weinmann]

Hi again and I really apreciate all your help. Thanks.

By the way I was just reading a book called "Using Samba" yesterday.
While looking at the book cover I fell over the name "Gerarld
Carter".... what a small world. :) It's a great book. Couldn't stop
reading. I found that with the command "net ads keytab add NFS".

maybe that will solve the problem? I will give it a try and also append
the prefered enctypes to krb5.conf.

Regards,
Oli  

-----Original Message-----
From: simo [mailto:idra at samba.org] 
Sent: 02 April 2008 17:47
To: Gerald (Jerry) Carter
Cc: Oliver Weinmann; samba at lists.samba.org
Subject: Re: [Samba] Urgent... winbind and keytab file creation


On Wed, 2008-04-02 at 10:39 -0500, Gerald (Jerry) Carter wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Oliver Weinmann wrote:
> > Ok. i got it. I had to change the parameter for:
> > 
> > krb5_ccache_type = FILE
> > 
> > now the users get a "cached" ticket at login. COOL :)
> > 
> > but when the automount daemon tries to mount their home it fails:
> > 
> > Apr  2 16:41:09 rhel4wbtest2 rpc.gssd[1793]: WARNING: Failed to 
> > create
> > krb5 context for user with uid 82967 for server 
> > ds-san-02.vegagroup.net Apr  2 16:41:12 rhel4wbtest2 rpc.gssd[1793]:
rpcsec_gss:
> > gss_init_sec_context: (major) Miscellaneous failure - (minor) No 
> > credentials found with supported encryption types
> 
> 
> I expect the nfsv4 service is trying to use 3des or aes.
> I always set these enc types in /etc/krb5.conf
> 
> [libdefaults]
>     default_tgs_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5
>     default_tkt_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5
>     preferred_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
> 

Currently linux nfs server requires that both server and client use ONLY
des keys Any other combination will simply fail.

There are kernel patches reaching upstream that are adding 3des and aes
but not yet rc4-hmac IIRC.

Simo.

--
Simo Sorce
Samba Team GPL Compliance Officer <simo at samba.org> Senior Software
Engineer at Red Hat Inc. <ssorce at redhat.com>


______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________