From: Grant Taylor via TUHS <tuhs@minnie.tuhs.org>
To: tuhs@minnie.tuhs.org
Subject: Re: [TUHS] NFS & Kerberos woes... — SOLVED
Date: Wed, 26 Dec 2018 23:24:00 -0700 [thread overview]
Message-ID: <357ec30a-5fe3-80d4-ef04-2c8d336a46cc@spamtrap.tnetconsulting.net> (raw)
In-Reply-To: <bd626b01-b74a-14d9-c31e-6b5437464387@spamtrap.tnetconsulting.net>
[-- Attachment #1: Type: text/plain, Size: 1324 bytes --]
On 12/25/18 5:49 PM, Grant Taylor via TUHS wrote:
> Do any fellow TUHS subscribers have any experience with NFS,
> particularly in combination with Kerberos authentication?
After much toil and tribulation, I've managed to get things working.
> I'm messing with something that is making me think that Kerberos
> authentication (sec=krb5{,i,p}) usurps no_root_squash.
I've found that no_root_squash is still equally as applicable in
Kerberized NFS as it is in non-Kerberized NFS. no_root_squash actually
still does the same thing in Kerberized NFS.
I figured out (by grinding through possible options) that I needed to do
the following:
Add a new principal, root/host.sub.domain.tld, and add it to host's
(system wide) keytab file.
I also needed to configure and enable translations in the
/etc/idmapd.conf file /on/ /the/ /NFS/ /server/.
--8<--
[Static]
root/host.sub.domain.tld = root
[Translation]
GSS-Methods = static,nsswitch
-->8--
Hopefully this will help someone trying to do something similar in the
future.
Now, services running as root (sshd) are able to read files
(authorized_keys) that root doesn’t have permission to read (owned by
user and 0600) on an NFS mount (/home) that is using Kerberos
authentication.
--
Grant. . . .
unix || die
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4008 bytes --]
prev parent reply other threads:[~2018-12-27 6:24 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-26 0:49 [TUHS] NFS & Kerberos woes Grant Taylor via TUHS
2018-12-26 2:01 ` Larry McVoy
2018-12-26 4:49 ` Theodore Y. Ts'o
2018-12-26 8:45 ` Grant Taylor via TUHS
2018-12-27 6:27 ` Grant Taylor via TUHS
2018-12-26 8:48 ` Grant Taylor via TUHS
2018-12-27 6:24 ` Grant Taylor via TUHS [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=357ec30a-5fe3-80d4-ef04-2c8d336a46cc@spamtrap.tnetconsulting.net \
--to=tuhs@minnie.tuhs.org \
--cc=gtaylor@tnetconsulting.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).