1

I'm trying to mount home directories over nfs on a few clients. Mounting works but I cannot cd /srv/nfs4: Permission denied. root can enter those mounted directories and read files there. Checking as root, files show up with the correct user names, groups, uids and gids.

Checking as a regular user:

testuser@nastest:/srv$ ls -l
ls: cannot access 'nfs4': Permission denied
total 0
d????????? ? ? ? ?            ? nfs4
testuser@nastest:/srv$ cd nfs4
-bash: cd: nfs4: Permission denied

My setup

Two fresh vms (kms on proxmox) with Ubuntu 16.04: nas.domain.tld and nastest.domain.tld, enrolled to a FreeIPA domain on auth.domain.tld, so user names and uids are centrally managed.

My /etc/exports:

srv/nfs4               gss/krb5i(rw,fsid=root,crossmnt,no_subtree_check)
/srv/nfs4/homes         gss/krb5i(rw,no_subtree_check)

/srv/nfs4is just a directory (root:root, 755), /srv/nfs4/homes is bind-mounted to /home where a directory owned by a FreeIPA-based user exists (755).

On the client, /etc/fstab:

nas.domain.tld:/ /srv/nfs4/ nfs4 sec=krb5i 0 0

RDNS works, I've explicitly set the same domain for both hosts in /etc/idmapd.conf.

How can I make this work for regular users?

0

I have filed a bug against the freeipa-client package.

The problem was that gssd in Ubuntu 16.04 does not seem to support kernel keyring backed credential caches for kerberos. However, the ipa-client-install script creates /etc/krb5.conf in a way that relies on those.

Deleting the line default_ccache_name = KEYRING:persistent:%{uid} fixed the issue for me.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.