Unsolved
This post is more than 5 years old
38 Posts
0
716
May 20th, 2009 05:00
Superuser access to Kerberized NFSv4 exported filesytem
How does one go about setting up the kerberos principals and NFSv4 usermapping on a Kerberized (krb5, krb5i or krb5p) NFSv4 export such that the root user on the NFS client has superuser equivalent acces on the underlying filesystem?
This doesn't seem to be covered in any of the docs on:
- NFS
- CIFS
- Multiprrotocol Support
- Usermapping
- Name Services
Note that in my case we are using Red Hat Enterprise 5/CentOS 5 as NFSv4 Clients and DART 5.6.42.501 as the NFSv4 Server.
Note also that the NFS client in these versions of of Linux use the kerberos principal nfs/hostname@REALM for all access to the NFSv4 mount regardless of the kerberos principals that the root user has in their cache.
The export itself is exported with root=myclientmachine and sec=sys based root access works fine. This seems to be all to do with the NFSv4 mapping and the principals involved.
I'm mainly after an ideal world example of how one should configure this rather than looking at our particular config.
Message was edited by:
Carwyn
This doesn't seem to be covered in any of the docs on:
- NFS
- CIFS
- Multiprrotocol Support
- Usermapping
- Name Services
Note that in my case we are using Red Hat Enterprise 5/CentOS 5 as NFSv4 Clients and DART 5.6.42.501 as the NFSv4 Server.
Note also that the NFS client in these versions of of Linux use the kerberos principal nfs/hostname@REALM for all access to the NFSv4 mount regardless of the kerberos principals that the root user has in their cache.
The export itself is exported with root=myclientmachine and sec=sys based root access works fine. This seems to be all to do with the NFSv4 mapping and the principals involved.
I'm mainly after an ideal world example of how one should configure this rather than looking at our particular config.
Message was edited by:
Carwyn
No Events found!
MarcoP1
1 Message
0
August 17th, 2009 11:00
We are trying to achieve exactly the same thing. Let a root user manage the underlying directories with a kerberos mount.
Is this question ever answered ?
Thank you .... Greetings ... Richard
carwynedwards
38 Posts
0
August 27th, 2009 06:00
We have an "admin" box now that is only used to manipulate the NFSv4 shares as root. Not something we have to do very often thankfully.
Richard1074
1 Message
0
August 27th, 2009 07:00
Ok, so you have a dedicated admin box ? But how does your exports on the filer looks like ?
Something like this ?
export "/fs_nfs3/export1" sec=krb5 nfsv4only
export "/fs_nfs3/export1" root=
Or is your adminbox access also krb5 ?
Greetings .. Richard