centos 和 kerberized nfs 工作正常，但僅適用於 nfs3

我想掛載一個 nfs4 kerberized 共享。我在centos7上，kerberos伺服器是Freeipa，客戶端是centos7。問題是我的配置適用於 nfs3，但不適用於 nfs4。首先我把我的配置

/etc/出口

/export         10.2.0.0/24(ro,no_subtree_check,fsid=0,)
/export/public      10.2.0.0/24(ro,no_subtree_check,async,root_squash,nohide,sec=sys)
/export/private     10.2.0.0/24(ro,no_subtree_check,async,root_squash,nohide,sec=krb5p)

/etc/nfsmount.conf

  [ NFSMount_Global_Options ]
   Defaultvers=4
   Defaultproto=tcp
   mountport=4001
   Port=2049

/etc/krb5.conf

#File modified by ipa-client-install

includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/

[libdefaults]
 default_realm = MYREALM.FAKE
 dns_lookup_realm = true
 dns_lookup_kdc = true
 rdns = false
 dns_canonicalize_hostname = false
 ticket_lifetime = 24h
 forwardable = true
 udp_preference_limit = 0
 default_ccache_name = KEYRING:persistent:%{uid}


[realms]
 MYREALM.FAKE = {
   pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
   pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem

 }


[domain_realm]
 .myrealm.fake = MYREALM.FAKE
 myrealm.fake = MYREALM.FAKE
 centos1.myrealm.fake = MYREALM.FAKE

我得到我的鑰匙

echo mypassword|kinit myuser

klist 報告 ok

現在，嘗試在沒有 kerberos+nfs4 的情況下掛載“public”

mount -t nfs  centos1:/public /mnt/ -vvv
mount.nfs: timeout set for Sat Mar  2 14:23:05 2019
mount.nfs: trying text-based options 'mountport=4001,port=2049,vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'

沒關係

現在沒有 kerberos+nfs3 的“公眾”

mount -t nfs  centos1:/export/public /mnt/ -vvv
mount.nfs: timeout set for Sat Mar  2 14:26:41 2019
mount.nfs: trying text-based options 'vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'
mount.nfs: mount(2): No such file or directory
mount.nfs: trying text-based options 'addr=10.2.0.77'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: trying 10.2.0.77 prog 100003 vers 3 prot TCP port 2049
mount.nfs: prog 100005, trying vers=3, prot=17
mount.nfs: trying 10.2.0.77 prog 100005 vers 3 prot UDP port 20048

沒關係

現在是 kerberos+nfs3 的“私有”

mount -t nfs  centos1:/export/private /mnt/ -vvv
mount.nfs: timeout set for Sat Mar  2 14:28:05 2019
mount.nfs: trying text-based options 'vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'
mount.nfs: mount(2): No such file or directory
mount.nfs: trying text-based options 'addr=10.2.0.77'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: trying 10.2.0.77 prog 100003 vers 3 prot TCP port 2049
mount.nfs: prog 100005, trying vers=3, prot=17
mount.nfs: trying 10.2.0.77 prog 100005 vers 3 prot UDP port 20048

沒關係。

問題是如果我嘗試使用 nfs4

mount -t nfs4  centos1:/private /mnt/ -vvv
mount.nfs4: timeout set for Sat Mar  2 14:29:54 2019
mount.nfs4: trying text-based options 'vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'
mount.nfs4: mount(2): Operation not permitted
mount.nfs4: Operation not permitted

我也從其他客戶端嘗試過，同樣的錯誤 Ipa 伺服器報告

Mar 02 14:29:12 freeipa.realm.fake krb5kdc[611](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.2.0.77: NEEDED_PREAUTH: admin@REALM.FAKE for krbtgt/REALM.FAKE@REALM.FAKE, Additional pre-authentication required
Mar 02 14:29:12 freeipa.realm.fake krb5kdc[611](info): closing down fd 11
Mar 02 14:29:12 freeipa.realm.fake krb5kdc[611](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.2.0.77: ISSUE: authtime 1551533352, etypes {rep=18 tkt=18 ses=18}, admin@REALM.FAKE for krbtgt/REALM.FAKE@REALM.FAKE
Mar 02 14:29:12 freeipa.realm.fake krb5kdc[611](info): closing down fd 11

為什麼 nfs kerberized 僅適用於 nfs3？我試過禁用firewalld和selinux：同樣的事情。

找到解決方案，我已將 /etc/exports 編輯為這樣

/export             10.2.0.0/24(ro,no_subtree_check,fsid=0,sec=krb5p:sys)
/export/private         10.2.0.0/24(ro,no_subtree_check,async,root_squash,nohide,sec=krb5p)
/export/public      10.2.0.0/24(ro,no_subtree_check,async,root_squash,nohide,sec=sys)

現在完美執行。

mount -vvv -t nfs4 -o sec=krb5p  centos1.myrealm.fake:/private /mnt
mount.nfs4: timeout set for Sun Mar  3 09:59:06 2019
mount.nfs4: trying text-based options 'sec=krb5p,vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'
umount /mnt
mount -vvv -t nfs4 -o sec=sys  centos1.myrealm.fake:/public /mnt
mount.nfs4: timeout set for Sun Mar  3 09:59:19 2019
mount.nfs4: trying text-based options 'sec=sys,vers=4.1,addr=10.2.0.77,clientaddr=10.2.0.77'

引用自：https://unix.stackexchange.com/questions/503959