From Linux NFS

(Difference between revisions)

Latest revision as of 20:56, 14 February 2013

This document describes using FreeIPA for Kerberos and LDAP services with NFS.

Historically, configuring secure NFS has been challenging, especially when it requires setting up and administering a Kerberos realm. FreeIPA provides a packaged service of Kerberos 5, LDAP and helper software (ntp, httpd for admin interface, etc) with both a cli and web-based admin interface.

1 Important notes about the following examples
2 Check DNS Configuration
- 2.1 Add SRV records to your DNS zone
3 Install and configure the FreeIPA server
- 3.1 Install the FreeIPA server and admintools package
- 3.2 Configure FreeIPA server
  - 3.2.1 Common Problems
4 Install and configure FreeIPA client
- 4.1 Install the FreeIPA client package
- 4.2 Configure the FreeIPA client
  - 4.2.1 Common Problems
5 Setup Kerberos principals
- 5.1 Add a host principal for the client
- 5.2 Add a service principal for the NFS service on the server
6 Setup keytab on client and server
- 6.1 Server
- 6.2 Client
7 Add debug flags for rpc.gssd and rpc.svcgssd
8 Turn on "Secure NFS" on both client and server
- 8.1 Fedora 16
  - 8.1.1 Server
  - 8.1.2 Client
- 8.2 Fedora 15
9 Set up /etc/exports on the server
10 Mount the filesystem
11 Test the NFS mount as another user
- 11.1 Add another user
- 11.2 Test NFS
12 Older Distros
13 Solaris 11
- 13.1 Time synchronization
- 13.2 Reboot

Important notes about the following examples

These instructions are for Fedora 16 with notes from Fedora 15. Other distros will require similar setup - the key differences will be:
- a package installation tool other than yum
- a different config file layout

This example uses a private network (192.168.56.0/24) with a fake DNS realm (example.fake). Fake DNS zones are not recommended for production systems, but they can be very useful for testing environments - for more see Create a fake DNS realm for testing. If you are using a real DNS domain, the following instructions should point you in the right direction.

For simplicity, this domain only has one server server.example.fake (also the KDC/FreeIPA server) and one client client1.example.fake.

This example is running on a NAT'd private network, so I just turned off the firewall on the server. You probably shouldn't do that! You'll need to allow traffic on:
- port 53 (TCP and UDP) for named
- port 80, 443 (TCP) for httpd (FreeIPA web interface)
- ports 88 and 464 (TCP and UDP) for Kerberos
- ports 389, 636 (TCP and UDP) for LDAP
- ports 123 (UDP) for NTP (network time protocol)
- port 2049 (TCP and UDP) for NFS

SELinux is in 'permissive' mode. Running in 'enforced' mode will require additional steps.

You must be root on both the client and server to run (most of) these commands. In this example, all commands are run as root. I chose list all commands using sudo because this gets confusing when using kerberos (kinit then sudo and you no longer have tickets).

Check DNS Configuration

DNS must be configured for all machines using kerberos.

Make sure the full DNS names and reverse mappings exist for the client and server:

[root@client1 ~]# nslookup server.example.fake
Server:		192.168.56.20
Address:	192.168.56.20#53

Name:	server.example.fake
Address: 192.168.56.20

[root@client1 ~]# nslookup 192.168.56.20
Server:		192.168.56.20
Address:	192.168.56.20#53

20.56.168.192.in-addr.arpa	name = server.example.fake.

[root@client1 ~]# nslookup client1.example.fake
Server:		192.168.56.20
Address:	192.168.56.20#53

Name:	client1.example.fake
Address: 192.168.56.40

[root@client1 ~]# nslookup 192.168.56.40
Server:		192.168.56.20
Address:	192.168.56.20#53

40.56.168.192.in-addr.arpa	name = client1.example.fake.

Add SRV records to your DNS zone

To make auto-discovery work, you have to add the following service entries to the zone file for your domain:

; DNS auto discovery of services
_ldap._tcp      SRV 10 10 389 server.example.fake.
_kerberos._udp  SRV 10 10 88 server.example.fake.
_kerberos._tcp  SRV 10 10 88 server.example.fake.

This is optional, but the rest of the examples assume you have the proper SRV records for auto-discovery. If you don't, you'll have to manually enter information in ipa-server-install and ipa-client-install.

Install and configure the FreeIPA server

Install and configure the FreeIPA software on the server (server.example.fake).

Install the FreeIPA server and admintools package

This step fetches and installs FreeIPA and it's dependencies. Other linux distros will have a similar command.

[root@server ~]# yum install freeipa-server freeipa-admintools

Configure FreeIPA server

Run the ipa-server-install program. This takes a while.

All of the default answers should work if DNS hostnames and services are set up correctly and the full domain name is returned by hostname.

[root@server ~]# ipa-server-install 

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the FreeIPA Server.

This includes:
  * Configure the Network Time Daemon (ntpd)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)

To accept the default shown in brackets, press the Enter key.

Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.


Server host name [server.example.fake]: 

The domain name has been calculated based on the host name.

Please confirm the domain name [example.fake]: 

The IPA Master Server will be configured with
Hostname:    server.example.fake
IP address:  192.168.56.20
Domain name: example.fake

The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.

Please provide a realm name [EXAMPLE.FAKE]: 
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.

Directory Manager password: 
Password (confirm): 

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password: 
Password (confirm): 


The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Configuring ntpd
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
done configuring ntpd.
Configuring directory server for the CA: Estimated time 30 seconds
  [1/3]: creating directory server user
  [2/3]: creating directory server instance
  [3/3]: restarting directory server
done configuring pkids.
Configuring certificate server: Estimated time 6 minutes
  [1/17]: creating certificate server user
  [2/17]: creating pki-ca instance
  [3/17]: restarting certificate server
  [4/17]: configuring certificate server instance
  [5/17]: restarting certificate server
  [6/17]: creating CA agent PKCS#12 file in /root
  [7/17]: creating RA agent certificate database
  [8/17]: importing CA chain to RA certificate database
  [9/17]: restarting certificate server
  [10/17]: requesting RA certificate from CA
  [11/17]: issuing RA agent certificate
  [12/17]: adding RA agent as a trusted user
  [13/17]: fixing RA database permissions
  [14/17]: setting up signing cert profile
  [15/17]: set up CRL publishing
  [16/17]: configuring certificate server to start on boot
  [17/17]: restarting certificate server
done configuring pki-cad.
Configuring directory server: Estimated time 1 minute
  [1/32]: creating directory server user
  [2/32]: creating directory server instance
  [3/32]: adding default schema
  [4/32]: enabling memberof plugin
  [5/32]: enabling referential integrity plugin
  [6/32]: enabling winsync plugin
  [7/32]: configuring replication version plugin
  [8/32]: enabling IPA enrollment plugin
  [9/32]: enabling ldapi
  [10/32]: configuring uniqueness plugin
  [11/32]: configuring uuid plugin
  [12/32]: configuring modrdn plugin
  [13/32]: enabling entryUSN plugin
  [14/32]: configuring lockout plugin
  [15/32]: creating indices
  [16/32]: configuring ssl for ds instance
  [17/32]: configuring certmap.conf
  [18/32]: configure autobind for root
  [19/32]: restarting directory server
  [20/32]: adding default layout
  [21/32]: adding delegation layout
  [22/32]: adding replication acis
  [23/32]: configuring user private groups
  [24/32]: configuring netgroups from hostgroups
  [25/32]: creating default Sudo bind user
  [26/32]: creating default HBAC rule allow_all
  [27/32]: initializing group membership
  [28/32]: adding master entry
  [29/32]: configuring Posix uid/gid generation
  [30/32]: enabling compatibility plugin
  [31/32]: tuning directory server
  [32/32]: configuring directory to start on boot
done configuring dirsrv.
Configuring Kerberos KDC: Estimated time 30 seconds
  [1/14]: setting KDC account password
  [2/14]: adding sasl mappings to the directory
  [3/14]: adding kerberos entries to the DS
  [4/14]: adding default ACIs
  [5/14]: configuring KDC
  [6/14]: adding default keytypes
  [7/14]: adding default password policy
  [8/14]: creating a keytab for the directory
  [9/14]: creating a keytab for the machine
  [10/14]: exporting the kadmin keytab
  [11/14]: adding the password extension to the directory
  [12/14]: adding the kerberos master key to the directory
  [13/14]: starting the KDC
  [14/14]: configuring KDC to start on boot
done configuring krb5kdc.
Configuring ipa_kpasswd
  [1/2]: starting ipa_kpasswd 
  [2/2]: configuring ipa_kpasswd to start on boot
done configuring ipa_kpasswd.
Configuring the web interface: Estimated time 1 minute
  [1/12]: disabling mod_ssl in httpd
  [2/12]: setting mod_nss port to 443
  [3/12]: setting mod_nss password file
  [4/12]: adding URL rewriting rules
  [5/12]: configuring httpd
  [6/12]: setting up ssl
  [7/12]: setting up browser autoconfig
  [8/12]: publish CA cert
  [9/12]: creating a keytab for httpd
  [10/12]: configuring SELinux for httpd
  [11/12]: restarting httpd
  [12/12]: configuring httpd to start on boot
done configuring httpd.
Setting the certificate subject base
restarting certificate server
Applying LDAP updates
Restarting the directory server
Restarting the KDC
Restarting the web server
Sample zone file for bind has been created in /tmp/sample.zone.I_fDwT.db
==============================================================================
Setup complete

Next steps:
	1. You must make sure these network ports are open:
		TCP Ports:
		  * 80, 443: HTTP/HTTPS
		  * 389, 636: LDAP/LDAPS
		  * 88, 464: kerberos
		UDP Ports:
		  * 88, 464: kerberos
		  * 123: ntp

	2. You can now obtain a kerberos ticket using the command: 'kinit admin'
	   This ticket will allow you to use the IPA tools (e.g., ipa user-add)
	   and the web user interface.

Be sure to back up the CA certificate stored in /root/cacert.p12
This file is required to create replicas. The password for this
file is the Directory Manager password

Common Problems

ipa-server-install --uninstall is useful if you encounter an error on running ipa-server-install. Some common issues are: selinux being enabled, iptables blocking ports. Upon successful installation of IPA, ipa-server-install --uninstall doesn't seem to cleanup everything needed to run ipa-server-install again.

Install and configure FreeIPA client

Install the freeipa-client package on each client of the FreeIPA domain.

Install the FreeIPA client package

Fetch and install the FreeIPA client.

[root@client1 ~]# yum install freeipa-client
...

Configure the FreeIPA client

Again, if DNS is setup correctly and hostname returns the full DNS name, the default answers should work.

You want to use "admin" (the administrator user you created when configuring the FreeIPA server) as the enrollment principal.

[root@client1 ~]# ipa-client-install 
Discovery was successful!
Hostname: client1.example.fake
Realm: EXAMPLE.FAKE
DNS Domain: example.fake
IPA Server: server.example.fake
BaseDN: dc=example,dc=fake


Continue to configure the system with these values? [no]: yes
Enrollment principal: admin
Password for admin@EXAMPLE.FAKE: 

Enrolled in IPA realm EXAMPLE.FAKE
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm EXAMPLE.FAKE
SSSD enabled
Kerberos 5 enabled
NTP enabled
Client configuration complete.

Common Problems

Joining realm failed because of failing XML-RPC request.
  This error may be caused by incompatible server/client major versions.

This was seen on older Fedora 15 installs, but has since been fixed (on yum 'update' repositories). The problem and workaround are described here: https://www.redhat.com/archives/freeipa-users/2011-July/msg00029.html

Recent releases of Fedora use chronyd for time synchronization. Chronyd is more tolerant of long network outages typical of mobile computing.

However, IPA continues to rely on ntp. The IPA installation and configuration process is supposed to replace chronyd with ntpd automatically, but sometimes this does not happen on IPA clients. You can ensure these services are properly configured by issuing the following commands on your IPA client:

# systemctl stop chronyd.service
# systemctl disable chronyd.service
# systemctl start ntpd.service
# systemctl enable ntpd.service

Check the ntpd configuration:

[root@seurat ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*server.example. 17.151.16.20     3 u   79  128  377    1.173  -137.78  10.771

You should see the IPA server listed here.

You should not see a LOCAL time source. If you do, edit ntp.conf and remove or comment out lines that look like this:

server 127.127.1.0     # local clock
fudge  127.127.1.0 stratum 10

Then restart ntpd.service.

Setup Kerberos principals

The next step is to setup the needed Kerberos principals: a host principal for the client and a service principal for the NFS service on the server. Note that the server also needs a host principal, but this has already been made in this example because the server is also the FreeIPA server and had it's host principal created as part of ipa-server-install.

You must be authenticated as an administrator to run the following commands. klist will tell you if you are. If you need to authenticate as admin, run kinit admin.

You can also do this through the FreeIPA web administration interface. See: Using the FreeIPA Web UI

Add a host principal for the client

[root@server ~]$ ipa host-add client1.example.fake
---------------------------------
Added host "client1.example.fake"
---------------------------------
  Host name: client1.example.fake
  Principal name: host/client1.example.fake@EXAMPLE.FAKE
  Keytab: False
  Password: False
  Managed by: client1.example.fake

Add a service principal for the NFS service on the server

[root@server ~]# ipa service-add nfs/server.example.fake
----------------------------------------------------
Added service "nfs/server.example.fake@EXAMPLE.FAKE"
----------------------------------------------------
  Principal: nfs/server.example.fake@EXAMPLE.FAKE
  Managed by: server.example.fake

Setup keytab on client and server

Both the client and server must have host keys (for principal host/<host's full dns name>) in the keytab. The server must also have keys from the nfs service (nfs/<server's full dns name>.

Server

Get the host keys:

[root@server ~]# ipa-getkeytab -s server.example.fake -p host/server.example.fake -k /etc/krb5.keytab
Keytab successfully retrieved and stored in: /etc/krb5.keytab

Get the service keys:

[root@server ~]# ipa-getkeytab -s server.example.fake -p nfs/server.example.fake -k /etc/krb5.keytab
Keytab successfully retrieved and stored in: /etc/krb5.keytab

Check to see what's in the keytab:

[root@server ~]# klist -ke /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 host/server.example.fake@EXAMPLE.FAKE (aes256-cts-hmac-sha1-96)
   2 host/server.example.fake@EXAMPLE.FAKE (aes128-cts-hmac-sha1-96) 
   2 host/server.example.fake@EXAMPLE.FAKE (des3-cbc-sha1) 
   2 host/server.example.fake@EXAMPLE.FAKE (arcfour-hmac) 
   2 host/server.example.fake@EXAMPLE.FAKE (des-hmac-sha1) 
   2 host/server.example.fake@EXAMPLE.FAKE (des-cbc-md5) 
   1 nfs/server.example.fake@EXAMPLE.FAKE (aes256-cts-hmac-sha1-96) 
   1 nfs/server.example.fake@EXAMPLE.FAKE (aes128-cts-hmac-sha1-96) 
   1 nfs/server.example.fake@EXAMPLE.FAKE (des3-cbc-sha1) 
   1 nfs/server.example.fake@EXAMPLE.FAKE (arcfour-hmac) 
   3 host/server.example.fake@EXAMPLE.FAKE (aes256-cts-hmac-sha1-96) 
   3 host/server.example.fake@EXAMPLE.FAKE (aes128-cts-hmac-sha1-96) 
   3 host/server.example.fake@EXAMPLE.FAKE (des3-cbc-sha1) 
   3 host/server.example.fake@EXAMPLE.FAKE (arcfour-hmac)

Client

Clients just need the host keys.

[root@client1 ~]# ipa-getkeytab -s server.example.fake -p host/client1.example.fake -k /etc/krb5.keytab
Keytab successfully retrieved and stored in: /etc/krb5.keytab

You can check the results in the same way as the server.

Add debug flags for rpc.gssd and rpc.svcgssd

This step is completely optional, but can really help with debugging problems.

Edit these lines in file "/etc/sysconfig/nfs":

# Optional arguments passed to rpc.gssd. See rpc.gssd(8)
RPCGSSDARGS="-vvv"
# Optional arguments passed to rpc.svcgssd. See rpc.svcgssd(8)
RPCSVCGSSDARGS="-vvv"

The -vvv flags dump debugging output in "/var/log/messages".

Turn on "Secure NFS" on both client and server

Fedora 16

Fedora 16 has changed this setup quite a bit:

Server

On the server you have to enable the nfs-server service to run nfsd:

[root@server ~]$ service nfs-server enable
Redirecting to /bin/systemctl  enable nfs-server.service
ln -s '/lib/systemd/system/nfs-server.service' '/etc/systemd/system/multi-user.target.wants/nfs-server.service'
[root@server ~]$ service nfs-server start
Redirecting to /bin/systemctl  start nfs-server.service

On the server you have to enable the nfs-secure-server service to run rpc.svcgssd:

[root@server ~]$ service nfs-secure-server enable
Redirecting to /bin/systemctl  enable nfs-secure-server.service
ln -s '/lib/systemd/system/nfs-secure-server.service' '/etc/systemd/system/multi-user.target.wants/nfs-secure-server.service'
[root@server ~]$ service nfs-secure-server start
Redirecting to /bin/systemctl  start nfs-secure-server.service

Client

On the client you have to enable the nfs-secure service:

[root@client1 ~]$ service nfs-secure enable
Redirecting to /bin/systemctl  enable nfs-secure.service
ln -s '/lib/systemd/system/nfs-secure.service' '/etc/systemd/system/multi-user.target.wants/nfs-secure.service'
[root@client1 ~]$ service nfs-secure start
Redirecting to /bin/systemctl  start nfs-secure.service

Fedora 15

This turns on NFS secure mounts and enables rpc.gssd and rpc.svcgssd services.

Edit this line in file "/etc/sysconfig/nfs":

# Set to turn on Secure NFS mounts.
SECURE_NFS="yes"

To pick up the changes, you must restart nfs services:

[root@client1 ~]# service nfs restart
Restarting nfs (via systemctl):                            [  OK  ]
[root@client1 ~]# service rpcgssd restart
Restarting rpcgssd (via systemctl):                        [  OK  ]
[root@client1 ~]# service rpcsvcgssd restart
Restarting rpcsvcgssd (via systemctl):                     [  OK  ]

This must be run on both clients and servers.

Set up /etc/exports on the server

Edit file "/etc/exports". This makes one krb5 mountpoint of /export to be mounted as "/" or "/export".

/export *(rw,sec=krb5,no_subtree_check,no_root_squash)

Have the nfs server pick up the changes:

[root@server ~]$ sudo exportfs  -r -v
exporting *:/export

Now exportfs should show the mount:

[root@server ~]# exportfs -av
exporting *:/export

Mount the filesystem

The moment of truth!

On a client, run mount with -o sec=krb5:

[root@client1 ~]# mount -v -t nfs -o sec=krb5 server.example.fake:/ /mnt
mount.nfs4: timeout set for Tue Jul 19 22:36:46 2011
mount.nfs4: trying text-based options 'sec=krb5,addr=192.168.56.20,clientaddr=192.168.56.40'
server.example.fake:/ on /mnt type nfs4 (rw,sec=krb5)

Now test it:

[root@client1 ~]# echo "test" > /mnt/example.com
[root@client1 ~]# cat /mnt/example.com
test

If you run in to problems, see Problems Mounting.

Test the NFS mount as another user

This section covers testing the NFS mount with other users.

Add another user

First, we need to add another user to FreeIPA.

This must be run with credentials. On the server, run:

[root@server ~]# ipa user-add someguy
First name: guy
Last name: someone
--------------------
Added user "someguy"
--------------------
  User login: someguy
  First name: guy
  Last name: someone
  Full name: guy someone
  Display name: guy someone
  Initials: gs
  Home directory: /home/someguy
  GECOS field: guy someone
  Login shell: /bin/sh
  Kerberos principal: someguy@EXAMPLE.FAKE
  UID: 25400004

Now set a temporary password for the user. The first time the user logs in, they must change it to something new.

[root@server ~]# ipa passwd someguy
Password: 
Enter Password again to verify: 
-------------------------------------------
Changed password for "someguy@EXAMPLE.FAKE"
-------------------------------------------

Test NFS

Now there is a new user on the client(s)!

[root@client1 ~]# su someguy
sh-4.2$ id
uid=25400004(someguy) gid=25400004(someguy) groups=25400004(someguy),25400001(ipausers) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Authenticate as the user:

sh-4.2$ kinit
Password for someguy@EXAMPLE.FAKE: 
Password expired.  You must change it now.
Enter new password: 
Enter it again:

Now test NFS:

sh-4.2$ echo bar > /mnt/foo
sh-4.2$ cat /mnt/foo
bar
sh-4.2$ ls -l /mnt
total 12
-rw-r--r--. 1 nobody  nobody  4 Jul 19 17:22 bar
-rw-r--r--. 1 nobody  nobody  5 Jul 19 22:35 example.com
-rw-r--r--. 1 someguy someguy 4 Jul 19 22:44 foo

Older Distros

These are some steps needed from older versions of Fedora, but were no longer needed in fedora 16.

Hosts' full DNS name in /etc/hosts

Older nfs-util program 'rpc.gssd' (or is this kerberos?) requires that the full dns name of the host be in /etc/hosts. The full DNS name must be the only entry on that line.

On the server:

[root@server ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

192.168.56.20 server.example.fake

This must be done on the client(s) as well:

[root@client1 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

192.168.56.40 client1.example.fake

Only fetch DES keys when using ipa-getkeytab

Older kernel and nfs-utils packages will require the use of the encryption type 'des-cbc-crc' (more).

To do this add the flag -e des-cbc-crc to ipa-getkeytab and make sure klist -ke /etc/krb5.keytab ONLY shows des keys - if there are other keys, erase the keytab and refetch the host and service keys with this flag.

Allow Kerberos to use "weak crypto"

If you needed to use -e des-cbc-crc when using ipa-getkeytab, you'll have to edit the /etc/krb5.conf on the server and client(s).

Edit file '/etc/krb5.conf':

In section "libdefaults", add the line:

allow_weak_crypto = true

The "libdefaults" section should look something like this:

[libdefaults]
  default_realm = EXAMPLE.FAKE
  dns_lookup_realm = false
  dns_lookup_kdc = false
  rdns = false
  ticket_lifetime = 24h
  forwardable = yes
  allow_weak_crypto = true

Solaris 11

The ipa-admintools package is not available for Solaris. Consequently, for each Solaris system that participates in your IPA Kerberos realm, you need to create a keytab on the IPA server and then copy the keytab to each system by hand.

The next steps assume you are logged into the IPA server and authenticated as an administrator. "solaris.example.fake" is the hostname of the Solaris system we are configuring in these examples.

[root@server ~]$ ipa host-add solaris.example.fake
---------------------------------
Added host "solaris.example.fake"
---------------------------------
  Host name: solaris.example.fake
  Principal name: host/solaris.example.fake@EXAMPLE.FAKE
  Keytab: False
  Password: False
  Managed by: solaris.example.fake

If your Solaris system will act as an NFS server, also create an NFS service principal for it.

[root@server ~]# ipa service-add nfs/solaris.example.fake
----------------------------------------------------
Added service "nfs/solaris.example.fake@EXAMPLE.FAKE"
----------------------------------------------------
  Principal: nfs/solaris.example.fake@EXAMPLE.FAKE
  Managed by: solaris.example.fake

Now, on the IPA server, construct a keytab for your Solaris system. Make sure no /tmp/krb5.keytab file exists before performing these steps.

[root@server ~]# ipa-getkeytab -s server.example.fake -p host/solaris.example.fake -k /tmp/krb5.keytab
Keytab successfully retrieved and stored in: /tmp/krb5.keytab

If your Solaris system will act as an NFS server, also extract the "nfs" service key you created above.

[root@server ~]# ipa-getkeytab -s server.example.fake -p nfs/solaris.example.fake -k /tmp/krb5.keytab
Keytab successfully retrieved and stored in: /tmp/krb5.keytab

Now check the contents of the keytab you just constructed. Note the "nfs" keys appear only if you added them in the previous step.

[root@server ~]# klist -ke /tmp/krb5.keytab 
Keytab name: FILE:/tmp/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   1 host/solaris.example.fake@EXAMPLE.FAKE (aes256-cts-hmac-sha1-96) 
   1 host/solaris.example.fake@EXAMPLE.FAKE (aes128-cts-hmac-sha1-96) 
   1 host/solaris.example.fake@EXAMPLE.FAKE (des3-cbc-sha1) 
   1 host/solaris.example.fake@EXAMPLE.FAKE (arcfour-hmac) 
   1 nfs/solaris.example.fake@EXAMPLE.FAKE (aes256-cts-hmac-sha1-96) 
   1 nfs/solaris.example.fake@EXAMPLE.FAKE (aes128-cts-hmac-sha1-96) 
   1 nfs/solaris.example.fake@EXAMPLE.FAKE (des3-cbc-sha1) 
   1 nfs/solaris.example.fake@EXAMPLE.FAKE (arcfour-hmac)

Copy /tmp/krb5.keytab on your IPA server to /etc/krb5/krb5.keytab on your Solaris system.

Finally, on your Solaris system, edit /etc/krb5/krb5.conf to reflect the configuration of your IPA Kerberos realm. Note the format Solaris uses for krb5.conf is slightly different than the one that Linux uses. It might look something like this:

[libdefaults]
        default_realm = EXAMPLE.FAKE

[realms]
        EXAMPLE.FAKE = {
                kdc = server.example.fake:88
                admin_server = server.example.fake:749
        }

[domain_realm]
        .example.fake = EXAMPLE.FAKE
        example.fake = EXAMPLE.FAKE

[logging]
        default = FILE:/var/krb5/kdc.log
        kdc = FILE:/var/krb5/kdc.log
        kdc_rotate = {
                period = 1d
                versions = 10
        }

[appdefaults]
        kinit = {
                renewable = true
                forwardable = true
        }

Time synchronization

Kerberos requires accurate time. The configuration file for ntpd is in /etc/inet/ntp.conf. Remove all lines beginning with "server" and add a line that says "server server.example.fake iburst".

Now "prime the pump." Ntpd doesn't synchronize time when the time offset between the time on your system and the time on the time server is too large.

# ntpdate server.example.fake
3 Apr 13:46:49 ntpdate[1183]: step time server 192.168.56.1 offset -7200.059798 sec

To ensure the ntp service is started automatically after a reboot, use:

# svcadm enable svc:/network/ntp:default

Reboot

After following all these steps, reboot your Solaris system to ensure these changes take effect permanently. Always check your work with a reboot!

@@ Line 329: / Line 329: @@
 This was seen on older Fedora 15 installs, but has since been fixed (on yum 'update' repositories).
 The problem and workaround are described here: https://www.redhat.com/archives/freeipa-users/2011-July/msg00029.html
+Recent releases of Fedora use chronyd for time synchronization.  Chronyd is more tolerant of long network outages typical of mobile computing.
+However, IPA continues to rely on ntp.  The IPA installation and configuration process is supposed to replace chronyd with ntpd automatically, but sometimes this does not happen on IPA clients.  You can ensure these services are properly configured by issuing the following commands on your IPA client:
+<pre>
+# systemctl stop chronyd.service
+# systemctl disable chronyd.service
+# systemctl start ntpd.service
+# systemctl enable ntpd.service
+</pre>
+Check the ntpd configuration:
+<pre>
+[root@seurat ~]# ntpq -p
+     remote           refid      st t when poll reach   delay   offset  jitter
+==============================================================================
+*server.example. 17.151.16.20     3 u   79  128  377    1.173  -137.78  10.771
+</pre>
+You should see the IPA server listed here.
+You should ''not'' see a LOCAL time source.  If you do, edit ntp.conf and remove or comment out lines that look like this:
+<pre>
+server 127.127.1.0     # local clock
+fudge  127.127.1.0 stratum 10
+</pre>
+Then restart ntpd.service.
 = Setup Kerberos principals =
@@ Line 768: / Line 799: @@
 </pre>
-An NTP service is also required.  The configuration file is in /etc/inet/ntp.conf.  Remove all lines beginning with "server" and add a line that says "server server.example.fake iburst".  To enable the service, use:
+== Time synchronization ==
+Kerberos requires accurate time.  The configuration file for ntpd is in /etc/inet/ntp.conf.  Remove all lines beginning with "server" and add a line that says "server server.example.fake iburst".
+Now "prime the pump."  Ntpd doesn't synchronize time when the time offset between the time on your system and the time on the time server is too large.
+<pre>
+# ntpdate server.example.fake
+Apr 13:46:49 ntpdate[1183]: step time server 192.168.56.1 offset -7200.059798 sec
+</pre>
+To ensure the ntp service is started automatically after a reboot, use:
 <pre>
 # svcadm enable svc:/network/ntp:default
 </pre>
+== Reboot ==
 After following all these steps, reboot your Solaris system to ensure these changes take effect permanently.  Always check your work with a reboot!

NFS and FreeIPA

From Linux NFS

Latest revision as of 20:56, 14 February 2013

Contents

Important notes about the following examples

Check DNS Configuration

Add SRV records to your DNS zone

Install and configure the FreeIPA server

Install the FreeIPA server and admintools package

Configure FreeIPA server

Common Problems

Install and configure FreeIPA client

Install the FreeIPA client package

Configure the FreeIPA client

Common Problems

Setup Kerberos principals

Add a host principal for the client

Add a service principal for the NFS service on the server

Setup keytab on client and server

Server

Client

Add debug flags for rpc.gssd and rpc.svcgssd

Turn on "Secure NFS" on both client and server

Fedora 16

Server

Client

Fedora 15

Set up /etc/exports on the server

Mount the filesystem

Test the NFS mount as another user

Add another user

Test NFS

Older Distros

Hosts' full DNS name in /etc/hosts

Only fetch DES keys when using ipa-getkeytab

Allow Kerberos to use "weak crypto"

Solaris 11

Time synchronization

Reboot

Views

Personal tools

Navigation

Search

Toolbox