# Setup for mounting kerberized nfs home directory - gssd not finding valid kerberos ticket

Our home directories are exported via kerberized nfs, so the user needs a valid kerberos ticket to be able to mount its home. This setup works fine with our existing clients & server.

Now we want to add some 11.10 client and thus set up ldap & kerberos together with pam_mount. The ldap authentication works and users can login via ssh, however their homes can not be mounted.

When pam_mount is configured to mount as root, gssd does not find a valid kerberos ticket and the mount fails.

Nov 22 17:34:26 zelda rpc.gssd[929]: handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 '
Nov 22 17:34:26 zelda rpc.gssd[929]: handling krb5 upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt2)
Nov 22 17:34:26 zelda rpc.gssd[929]: process_krb5_upcall: service is '<null>'
Nov 22 17:34:26 zelda rpc.gssd[929]: getting credentials for client with uid 0 for server purple.physcip.uni-stuttgart.de
Nov 22 17:34:26 zelda rpc.gssd[929]: CC file '/tmp/krb5cc_65678_Ku2226' being considered, with preferred realm 'PURPLE.PHYSCIP.UNI-STUTTGART.DE'
Nov 22 17:34:26 zelda rpc.gssd[929]: CC file '/tmp/krb5cc_65678_Ku2226' owned by 65678, not 0
Nov 22 17:34:26 zelda rpc.gssd[929]: WARNING: Failed to create krb5 context for user with uid 0 for server purple.physcip.uni-stuttgart.de
Nov 22 17:34:26 zelda rpc.gssd[929]: doing error downfall


When pam_mount is on the other hand configured with the noroot=1 option, then it cannot mount the volume at all.

Nov 22 17:33:58 zelda sshd[2226]: pam_krb5(sshd:auth): user phy65678 authenticated as phy65678@PURPLE.PHYSCIP.UNI-STUTTGART.DE
Nov 22 17:33:58 zelda sshd[2226]: Accepted password for phy65678 from 129.69.74.20 port 51875 ssh2
Nov 22 17:33:58 zelda sshd[2226]: pam_unix(sshd:session): session opened for user phy65678 by (uid=0)
Nov 22 17:33:58 zelda sshd[2226]: pam_mount(mount.c:69): Messages from underlying mount program:
Nov 22 17:33:58 zelda sshd[2226]: pam_mount(mount.c:73): mount: only root can do that
Nov 22 17:33:58 zelda sshd[2226]: pam_mount(pam_mount.c:521): mount of /Volumes/home/phy65678 failed


So how can we allow users of a specific group to perform nfs mounts? If this does not work, can we make pam_mount use root but pass the correct uid?

• This same problem applies to mounting CIFS shares with -osec=krb5 – AdmiralNemo Mar 8 '12 at 2:42
• Indeed, this problem has not been solved, yet. Shall I create another question with the same title and content or what do you mean by "repost"? – jan bernlöhr Mar 8 '12 at 10:11
• I thought with kerberized nfs, you mount as root (with the system keytab), but file access is done with each user's ticket. – Jayen Mar 20 '12 at 3:52
• removed query comment- will monitor – Ringtail Mar 25 '12 at 18:31
• Are you mounting /home /home/user or /home/user/mountpoint? The first one I think needs to be done prior to login. The second I have tried to do with sshfs, but it kept failing on GDM and lightdm login and I don't think it was sshfs's fault. The third should work, you just need to add the user to a group that is allowed to do nfs mounts. Please let me know though if you get the 2nd one to work. I'd be interested. – d_inevitable Apr 4 '12 at 13:16