Permission denied on mounted nfs folders

Question

I'm trying to mount home directories over nfs on a few clients. Mounting works but I cannot cd /srv/nfs4: Permission denied. root can enter those mounted directories and read files there. Checking as root, files show up with the correct user names, groups, uids and gids.

Checking as a regular user:

testuser@nastest:/srv$ ls -l
ls: cannot access 'nfs4': Permission denied
total 0
d????????? ? ? ? ?            ? nfs4
testuser@nastest:/srv$ cd nfs4
-bash: cd: nfs4: Permission denied

My setup

Two fresh vms (kms on proxmox) with Ubuntu 16.04: nas.domain.tld and nastest.domain.tld, enrolled to a FreeIPA domain on auth.domain.tld, so user names and uids are centrally managed.

My /etc/exports:

srv/nfs4               gss/krb5i(rw,fsid=root,crossmnt,no_subtree_check)
/srv/nfs4/homes         gss/krb5i(rw,no_subtree_check)

/srv/nfs4is just a directory (root:root, 755), /srv/nfs4/homes is bind-mounted to /home where a directory owned by a FreeIPA-based user exists (755).

On the client, /etc/fstab:

nas.domain.tld:/ /srv/nfs4/ nfs4 sec=krb5i 0 0

RDNS works, I've explicitly set the same domain for both hosts in /etc/idmapd.conf.

How can I make this work for regular users?

Answer 1

I have filed a bug against the freeipa-client package.

The problem was that gssd in Ubuntu 16.04 does not seem to support kernel keyring backed credential caches for kerberos. However, the ipa-client-install script creates /etc/krb5.conf in a way that relies on those.

Deleting the line default_ccache_name = KEYRING:persistent:%{uid} fixed the issue for me.