Как получить доступ к общей папке NFSv4 с аутентификацией Kerberos без прав root

Я настраиваю общую папку NFSv4 с аутентификацией Kerberos. Проблема, с которой я сталкиваюсь, заключается в том, что когда пользователь на клиентском компьютере запускается mount /mnt(см. Конфигурацию fstab ниже), он не может получить доступ к каталогу / mnt. Наверное, это связано с правами на билет Kerberos. Действительно, когда я это делаю, я получаю только билет, который принадлежит root.

Клиент = 192.168.1.2 и сервер = 192.168.1.1 - оба работают под управлением Ubuntu 18.04.1

Вот командные строки:

user@client:~$ mount -vvv /mnt mount.nfs4: timeout set for Mon Sep 10 16:55:58 2018 mount.nfs4: trying text-based options 'proto=tcp,port=2049,sec=krb5p,vers=4.2,addr=192.168.1.1,clientaddr=192.168.1.2'  user@client:~$ cd /mnt bash: cd: /mnt: Permission denied  user@client:~$ ll /tmp/krb5ccmachine_DOMAIN.FR  -rw------- 1 root root 1628 sept. 10 16:53 /tmp/krb5ccmachine_DOMAIN.FR  user@client:~$ sudo klist -c /tmp/krb5ccmachine_DOMAIN.FR  Ticket cache: FILE:/tmp/krb5ccmachine_DOMAIN.FR Default principal: nfs/client.domain.fr@DOMAIN.FR  Valid starting Expires Service principal 10/09/2018 16:53:42 11/09/2018 02:53:42 krbtgt/DOMAIN.FR@DOMAIN.FR renew until 11/09/2018 16:53:42 10/09/2018 16:53:42 11/09/2018 02:53:42 nfs/server.domain.fr@ renew until 11/09/2018 16:53:42 10/09/2018 16:53:42 11/09/2018 02:53:42 nfs/server.domain.fr@DOMAIN.FR renew until 11/09/2018 16:53:42  root@client:~# klist -k /etc/krb5.keytab  Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 3 nfs/client.domain.fr@DOMAIN.FR 3 nfs/client.domain.fr@DOMAIN.FR 

Я обнаружил, что когда я выполняю "kinit" из nfs / client.domain.fr с правами пользователя, а затем запускаю команду mount, я могу получить доступ к каталогу / mnt

user@client:~$ kinit nfs/client.domain.fr -t Documents/krb5.keytab  keytab specified, forcing -k user@client:~$ klist  Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: nfs/client.domain.fr@DOMAIN.FR  Valid starting Expires Service principal 10/09/2018 17:22:59 11/09/2018 03:22:59 krbtgt/DOMAIN.FR@DOMAIN.FR renew until 11/09/2018 17:22:59  user@client:~$ mount /mnt user@client:~$ cd /mnt user@client:/mnt$ ll total 12 drwxrwxrwx 3 root root 4096 sept. 4 10:30 ./ drwxr-xr-x 24 root root 4096 sept. 4 11:09 ../ drwxrwxrwx 2 root root 4096 sept. 10 16:14 media/  user@client:/mnt$ ll /tmp/krb5cc* -rw------- 1 user user 2037 sept. 10 17:23 /tmp/krb5cc_1000 -rw------- 1 root root 1628 sept. 10 17:23 /tmp/krb5ccmachine_DOMAIN.FR  user@client:/mnt$ sudo klist /tmp/krb5ccmachine_DOMAIN.FR  [sudo] Mot de passe de user :  Ticket cache: FILE:/tmp/krb5ccmachine_DOMAIN.FR Default principal: nfs/client.domain.fr@DOMAIN.FR  Valid starting Expires Service principal 10/09/2018 17:23:35 11/09/2018 03:23:35 krbtgt/DOMAIN.FR@DOMAIN.FR renew until 11/09/2018 17:23:35 10/09/2018 17:23:35 11/09/2018 03:23:35 nfs/server.domain.fr@ renew until 11/09/2018 17:23:35 10/09/2018 17:23:35 11/09/2018 03:23:35 nfs/server.domain.fr@DOMAIN.FR renew until 11/09/2018 17:23:35 

Мои файлы конфигурации:

/ etc / fstab на клиентском компьютере

# /etc/fstab: static file system information. # # Use 'blkid' to print the universally unique identifier for a # device; this may be used with UUID= as a more robust way to name devices # that works even if disks are added and removed. See fstab(5). # # <file system> <mount point> <type> <options> <dump> <pass> # / was on /dev/sda1 during installation UUID=14d26733-1eb1-4c23-b6eb-7be5564675a6 / ext4 errors=remount-ro 0 1 /swapfile none swap sw 0 0 server:/ /mnt nfs4 proto=tcp,port=2049,sec=krb5p,noauto,user 0 0 

/ etc / fstab на сервере:

# /etc/fstab: static file system information. # # Use 'blkid' to print the universally unique identifier for a # device; this may be used with UUID= as a more robust way to name devices # that works even if disks are added and removed. See fstab(5). # # <file system> <mount point> <type> <options> <dump> <pass> # / was on /dev/sda1 during installation UUID=6edf6c8d-be74-4908-91c4-4c7bb453bc76 / ext4 errors=remount-ro 0 1 /swapfile none swap sw 0 0 /home/media /export/media none bind 0 0 

/ etc / exports на сервере:

# /etc/exports: the access control list for filesystems which may be exported # to NFS clients. See exports(5). # # Example for NFSv2 and NFSv3: # /srv/homes hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check) # # Example for NFSv4: # /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check) # /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check) # /export 192.168.1.0/24(rw,fsid=0,no_subtree_check,sync,sec=krb5p,all_squash,anonuid=1000,anongid=1000) /export/media 192.168.1.0/24(rw,nohide,insecure,no_subtree_check,sync,sec=krb5p,all_squash,anonuid=1000,anongid=1000) 

Пользователь с uid = 1000 и gid = 1000 существует на клиенте и сервере. Я также попробовал с опцией root_squash.

/etc/krb5.conf на клиенте и сервере:

[logging] default = FILE:/tmp/krb5libs.log kdc = FILE:/tmp/krb5kdc.log admin_server = FILE:/tmp/kadmind.log  [libdefaults] default_realm = DOMAIN.FR  # The following krb5.conf variables are only for MIT Kerberos. kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true  # The following encryption type specification will be used by MIT Kerberos # if uncommented. In general, the defaults in the MIT Kerberos code are # correct and overriding these specifications only serves to disable new # encryption types as they are added, creating interoperability problems. # # The only time when you might need to uncomment these lines and change # the enctypes is if you have local software that will break on ticket # caches containing ticket encryption types it doesn't know about (such as # old versions of Sun Java).  # default_tgs_enctypes = des3-hmac-sha1 # default_tkt_enctypes = des3-hmac-sha1 # permitted_enctypes = des3-hmac-sha1  # The following libdefaults parameters are only for Heimdal Kerberos. fcc-mit-ticketflags = true  [realms] DOMAIN.FR = { kdc = kdc.domain.fr admin_server = kerberos.domain.fr default_domain = domain.fr }  [domain_realm] .domain.fr = DOMAIN.FR domain.fr = DOMAIN.FR 

/ etc / default / nfs-kernel-server на сервере:

# Number of servers to start up RPCNFSDCOUNT=8  # Runtime priority of server (see nice(1)) RPCNFSDPRIORITY=0  # Options for rpc.mountd. # If you have a port-based firewall, you might want to set up # a fixed port here using the --port option. For more information,  # see rpc.mountd(8) or http://wiki.debian.org/SecuringNFS # To disable NFSv4 on the server, specify '--no-nfs-version 4' here RPCMOUNTDOPTS="--manage-gids --debug all"  # Do you want to start the svcgssd daemon? It is only required for Kerberos # exports. Valid alternatives are "yes" and "no"; the default is "no". NEED_SVCGSSD="yes"  # Options for rpc.svcgssd. RPCSVCGSSDOPTS="-vvv" 

/ etc / default / nfs-common на клиенте и сервере:

# If you do not set values for the NEED_ options, they will be attempted # autodetected; this should be sufficient for most people. Valid alternatives # for the NEED_ options are "yes" and "no".   # Options for rpc.statd. # Should rpc.statd listen on a specific port? This is especially useful # when you have a port-based firewall. To use a fixed port, set this # this variable to a statd argument like: "--port 4000 --outgoing-port 4001". # For more information, see rpc.statd(8) or http://wiki.debian.org/SecuringNFS STATDOPTS=  # Do you want to start the gssd daemon? It is required for Kerberos mounts. NEED_GSSD=yes 

/ etc / hosts на клиенте и сервере:

127.0.0.1 localhost  # server 192.168.1.1 server.domain.fr server 192.168.1.1 domain.fr # Client 192.168.1.2 client.domain.fr client 

логи kdc:

sept. 10 16:48:06 server krb5kdc[545](info): setting up network... krb5kdc: setsockopt(10,IPV6_V6ONLY,1) worked krb5kdc: setsockopt(12,IPV6_V6ONLY,1) worked krb5kdc: setsockopt(14,IPV6_V6ONLY,1) worked sept. 10 16:48:06 server krb5kdc[545](info): set up 6 sockets sept. 10 16:48:06 server krb5kdc[572](info): commencing operation sept. 10 16:53:42 server krb5kdc[572](info): AS_REQ (8 etypes ) 192.168.1.2: NEEDED_PREAUTH: nfs/client.domain.fr@DOMAIN.FR for krbtgt/DOMAIN.FR@DOMAIN.FR, Additional pre-authentication required sept. 10 16:53:42 server krb5kdc[572](info): AS_REQ (8 etypes ) 192.168.1.2: ISSUE: authtime 1536591222, etypes, nfs/client.domain.fr@DOMAIN.FR for krbtgt/DOMAIN.FR@DOMAIN.FR sept. 10 16:53:42 server krb5kdc[572](info): TGS_REQ (8 etypes ) 192.168.1.2: ISSUE: authtime 1536591222, etypes, nfs/client.domain.fr@DOMAIN.FR for nfs/server.domain.fr@DOMAIN.FR 

Так что теперь я могу только смонтировать общую папку и получить к ней доступ с правами пользователя root на клиентском компьютере, потому что билет, который я получаю, принадлежит root. Можно ли получить билет, принадлежащий пользователю? Я хотел бы знать, возможно ли смонтировать общий каталог с пользователем и получить к нему доступ, не выполняя ранее kinit.

Если вам нужна дополнительная информация или у вас есть вопросы по поводу моей конфигурации, не стесняйтесь.