[Samba] Samba winbind and nfsv4 krb5

[steve]

On 02/13/2012 10:48 AM, Oliver Weinmann wrote:
> Hi All,
>
> I'm struggling since weeks to get samba winbind and a kerberized nfs mount running. We have a Netapp SAN exporting the nfs share with sec=krb5 and a Linux Client Ubuntu 10.04 Server trying to access the exported share. Accessing the share without krb5 (sec=sys) works fine. The linux machine is joined to an Windows 2008R2 domain and user/group lookups login via ssh etc. work fine.
>
> I have read many articles about using winbind to aquire the Kerberos tickets on login.
>
> What I have done so far is join the linux machine to our AD:
>
> net ads join -U Administrator
>
> After this my krb5.keytab file is filled with the following:
>
> root at ubuntu100432:~# klist -kte
> Keytab name: WRFILE:/etc/krb5.keytab
> KVNO Timestamp         Principal
> ---- ----------------- --------------------------------------------------------
>     2 02/13/12 09:34:59 host/ubuntu100432.a.space.corp at A.SPACE.CORP (DES cbc mode with CRC-32)
>     2 02/13/12 09:34:59 host/ubuntu100432.a.space.corp at A.SPACE.CORP (DES cbc mode with RSA-MD5)
>     2 02/13/12 09:34:59 host/ubuntu100432.a.space.corp at A.SPACE.CORP (ArcFour with HMAC/md5)
>     2 02/13/12 09:34:59 host/ubuntu100432 at A.SPACE.CORP (DES cbc mode with CRC-32)
>     2 02/13/12 09:34:59 host/ubuntu100432 at A.SPACE.CORP (DES cbc mode with RSA-MD5)
>     2 02/13/12 09:34:59 host/ubuntu100432 at A.SPACE.CORP (ArcFour with HMAC/md5)
>     2 02/13/12 09:34:59 UBUNTU100432$@A.SPACE.CORP (DES cbc mode with CRC-32)
>     2 02/13/12 09:34:59 UBUNTU100432$@A.SPACE.CORP (DES cbc mode with RSA-MD5)
>     2 02/13/12 09:34:59 UBUNTU100432$@A.SPACE.CORP (ArcFour with HMAC/md5)
>
> Then I add the nfs principal:
>
> net ads keytab add nfs -U Administrator
>
> This adds the princ to the keytab file:
>
>     2 02/13/12 09:36:11 nfs/ubuntu100432.a.space.corp at A.SPACE.CORP (DES cbc mode with CRC-32)
>     2 02/13/12 09:36:11 nfs/ubuntu100432.a.space.corp at A.SPACE.CORP (DES cbc mode with RSA-MD5)
>     2 02/13/12 09:36:11 nfs/ubuntu100432.a.space.corp at A.SPACE.CORP (ArcFour with HMAC/md5)
>     2 02/13/12 09:36:11 nfs/ubuntu100432 at A.SPACE.CORP (DES cbc mode with CRC-32)
>     2 02/13/12 09:36:11 nfs/ubuntu100432 at A.SPACE.CORP (DES cbc mode with RSA-MD5)
>     2 02/13/12 09:36:11 nfs/ubuntu100432 at A.SPACE.CORP (ArcFour with HMAC/md5)
>
> I restart the portmap service (this restarts statd idmapd and gssd)
>
> Service portmap restart
>
> Now when I try to mount the share I always get an access denied:
>
> Looking at /var/log/daemon.log reveals:
>
> handling krb5 upcall
> Full hostname for 'ds-san-02.a.space.corp' is 'ds-san-02.a.space.corp'
> Full hostname for 'ubuntu100432.a.space.corp' is 'ubuntu100432.a.space.corp'
> Key table entry not found while getting keytab entry for 'root/ubuntu100432.a.space.corp at A.SPACE.CORP'
> Success getting keytab entry for 'nfs/ubuntu100432.a.space.corp at A.SPACE.CORP'
> WARNING: Client not found in Kerberos database while getting initial ticket for principal 'nfs/ubuntu100432.a.space.corp at A.SPACE.CORP' using keytab 'WRFILE:/etc/krb5.keytab'
> ERROR: No credentials found for connection to server ds-san-02.a.space.corp
> doing error downcall
> destroying client clnt13
> destroying client clnt12
>
> I checked the host in AD with setspn -L and this lists the following:
>
> Registered ServicePrincipalNames for CN=ubuntu100432
> ace,DC=corp:
>      NFS/ubuntu100432.a.space.corp
>      NFS/ubuntu100432
>      HOST/ubuntu100432.a.space.corp
>      HOST/UBUNTU100432
>
> So there is no principal 'nfs/ubuntu100432.a.space.corp at A.SPACE.CORP'.
>
> Is there something special about Windows 2008 R2?
>
> Regards,
> Oliver
>
>
Hi

I don't think AD supports either DES nor arcfour out of the box. We have 
the same setup with Samba 4 which does and we can mount sec=krb5.

I don't think that this will make any difference in your case, but it 
may be woth a try. as unless you're running an old distro, you don't 
need the nfs principal in the client's keytab. See the man rpc.gssd(8). 
There's an up to date copy here:
  http://linux.die.net/man/8/rpc.gssd
We also tried to produce some readable kerberized nfs4 documentation:
http://linuxcostablanca.blogspot.com/2012/02/nfsv4-myths-and-legends.html
HTH,
Steve