Hi,

Hi,

quoted

Hi,

quoted

Is there any guide to install/test nfs sec=krb5?

A better document:
https://www.delltechnologies.com/asset/en-us/products/storage/industry-market/h17769_integrating_onefs_with_kerberos_wp.pdf
3.1.2 Configurations for Kerberized NFS with AD

we just directly add nfs/ SPN in 'Figure 5 Check SPNs in AD'.
and we no longer need ''ktpass.exe -mapUse'  in another document:
http://doc.isilon.com/ECS/3.3/AdminGuide/ecs_t_file_access_confgure_kerberos.html
http://doc.isilon.com/ECS/3.7/AdminGuide/GUID-2018CF69-5F1E-4F3A-BA90-3659F85DE415.html

and then 'mount.nfs4 -o sec=krb5' works in rocky linux 9.1.

I test more case with different nfs server / nfs client version.

SPN host/
	'realm join' auto create
SPN nfs/
	setspn.exe -S nfs/T3610 T3610; 	setspn.exe -S nfs/T3610.e16-tech.com T3610

'kinit -k  nfs/t3610.e16-tech.com@E16-TECH.COM' no need to work
'kinit -k host/t3610.e16-tech.com@E16-TECH.COM' no need to work.

el9: rocky linux 9.1
el8: oracle linux 8.6
el7: centos 7.9

nfs-server/el9   nfs-client OK/el7, *1/el8, OK/el9
nfs-server/el8   nfs-client OK/el7, *1/el8, *1/*2/el9
nfs-server/el7   nfs-client OK/el7, OK/el8, *1/*2/el9
   *1 Permission denied

sssd-ad/winbind-ad do not need rDNS.
but for nfs sec=krb5, we need rDNS to work.

here there is not only cables that connect to the switch, but also some cables 
that directly connect to another server.

   *2 Invalid argument     # when kernel 5.15 in nfs-server, kerenl 6.1 in nfs-client

rpc-gssd.service maybe NOT running.

we need 'systemctl enable --now nfs-client.target'
#vendor preset: disabled@el9, enabled@el7/el8

Now sec=krb5 works well here.

Best Regards
Wang Yugui (wangyugui@e16-tech.com)
2023/01/23

nfs-utils version:  1.3.0/el7, 2.3.3/el8, 2.5.4/el9
kernel: same 5.15.y/6.1.y on el9/el8/el7

Best Regards
Wang Yugui (wangyugui@e16-tech.com)
2023/01/23