Has anyone been able to mount NFSv3 or NFSv4 using kerberized NFS on Mac OS 10.9, 10.10 or 10.11? We have this working in Linux, but not Mac.
We are able to mount using AUTH_SYS, but using the sec=krb5 mount option results in an "Operation not permitted" error. Our Macs are bound to AD and are using Unix uid/gids.
as root works:
mount -t nfs nfs.server.com:/ifs/test /mnt/nfs
as a domain user does not:
mount -t nfs -o sec=krb5 nfs.server.com:/ifs/test /mnt/nfs
mount_nfs: can't mount /ifs/test from nfs.server.com onto /mnt: Operation not permitted
In our troubleshooting, we came across this article which details how kerberized NFS is not compatible with AD:
So we tried testing with 10.9.5 with the changes to krb5.conf with no luck.
After reaching out to Apple, we have tested with macOS Sierra as it's supposed to have AES support in RPCSEC_GSS and still no luck.
What I'm going to share below has not been updated in quite some time as I just haven't had time to go back and test newer OS X combinations with AD (and even newer versions of OneFS), but this is what I came up for a working Kerberized NFSv3 setup with OS X and AD. Last update on this was December of 2013 and was done for OneFS 6.5 which was still using kernel NFS. If your cluster is running 7.2 or later then any cluster sysctl changes won't work as the NFS service has been moved out of the kernel and into userspace.
I hope this helps...
isi_for_array -s "killall gssd" isi_for_array -s "killall nfsd" isi_for_array -s "killall -HUP nfsd" isi_for_array -s "tail -5 /var/log/nfs.log"
2013-09-16T13:11:58-07:00 <3.6> bernie-65524-1(id1) gssd: Generated dynamic keytab from pstore 2013-09-16T13:12:08-07:00 <3.6> bernie-65524-1(id1) nfsd: Acquiring credential for principal: nfs/bernie-655.bernielab.com 2013-09-16T13:12:08-07:00 <3.6> bernie-65524-1(id1) nfsd: Succeeded, acquired credentials for nfs/bernie-655.bernielab.com
[libdefaults] allow_weak_crypto = true
sudo mount -o sec=krb5 bernie-655.bernielab.com:/ifs/data/berniec1 /mnt
kdestroy, followed by
Originally, it looked like none of this would work on the Mac, and I had found the following details from other users that had difficulty. Keeping these here just in case I need to refer back to them.