Got it. You need to use short hostname - i.e. hostname should return only "client", not "client.domain.org". O. ________________________________ From: sssd-users-bounces(a)lists.fedorahosted.org [sssd-users-bounces(a)lists.fedorahosted.org] on behalf of Ondrej Valousek Sent: Tuesday, February 11, 2014 6:22 PM To: End-user discussions about the System Security Services Daemon Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem) Problem is here: Feb 11 16:00:39 client rpc.gssd[708]: WARNING: Client not found in Kerberos database while getting initial ticket for principal &#39;host/client.domain.org(a)DOMAIN.ORG&#39; using keytab 'FILE:/etc/krb5.keytab' Rpc.gssd needs to use CLIENT$(a)domain.org Krb5 principal. And yes, reverse DNS records would be nice :) HTH, Ondrej ________________________________ From: sssd-users-bounces(a)lists.fedorahosted.org [sssd-users-bounces(a)lists.fedorahosted.org] on behalf of Longina Przybyszewska [longina(a)sdu.dk] Sent: Tuesday, February 11, 2014 5:00 PM To: 'End-user discussions about the System Security Services Daemon' Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem) Hi, I have problem with mountning NFS4 file with Kerberos security ( I can mount without Kerberos security) Both test machines run Ubuntu-saucy I have the nfs4 server which joined to AD with ‘msktutil’ : Server’s /etc/krb5.keytab klist –ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 3 SERVER$(a)DOMAIN.ORG (arcfour-hmac) 3 SERVER$(a)DOMAIN.ORG (aes128-cts-hmac-sha1-96) 3 SERVER$(a)DOMAIN.ORG (aes256-cts-hmac-sha1-96) 3 host/server.domain.org(a)DOMAIN.ORG (arcfour-hmac) 3 host/server.domain.org(a)DOMAIN.ORG (aes128-cts-hmac-sha1-96) 3 host/server.domain.org(a)DOMAIN.ORG (aes256-cts-hmac-sha1-96) 3 nfs/server.domain.org(a)DOMAIN.ORG (arcfour-hmac) 3 nfs/server.domain.org(a)DOMAIN.ORG (aes128-cts-hmac-sha1-96) 3 nfs/server.domain.org(a)DOMAIN.ORG (aes256-cts-hmac-sha1-96) Then, joined client machine to AD with ‘realm’ command: alongina@client:~$ sudo realm join --verbose -U USER --computer-ou OU="Linux computers",OU=ADResources domain.org [sudo] password for alongina: * Resolving: _ldap._tcp.domain.org * Performing LDAP DSE lookup on: 10.144.5.17 * Performing LDAP DSE lookup on: 10.144.5.18 * Successfully discovered: domain.org Password for USER: * Unconditionally checking packages * Resolving required packages * Installing necessary packages: samba-common-bin * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.JAW8AX -U USER ads join domain.org createcomputer=ADResources/Linux computers Enter USER's password: DNS update failed! Using short domain name – AAA-BBB Joined 'CLIENT' to dns domain 'domain.org' No DNS domain configured for client. Unable to perform DNS Update. * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.JAW8AX -U USER ads keytab create Enter USER's password: * /usr/sbin/update-rc.d sssd enable update-rc.d: /etc/init.d/sssd: file does not exist * /usr/sbin/service sssd restart sssd stop/waiting sssd start/running, process 3597 * Successfully enrolled machine in realm ==============0000000========= klist –ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 4 host/client.domain.org(a)DOMAIN.ORG (des-cbc-crc) 4 host/client.domain.org(a)DOMAIN.ORG (des-cbc-md5) 4 host/client.domain.org(a)DOMAIN.ORG (aes128-cts-hmac-sha1-96) 4 host/client.domain.org(a)DOMAIN.ORG (aes256-cts-hmac-sha1-96) 4 host/client.domain.org(a)DOMAIN.ORG (arcfour-hmac) 4 host/CLIENT(a)DOMAIN.ORG (des-cbc-crc) 4 host/CLIENT(a)DOMAIN.ORG (des-cbc-md5) 4 host/CLIENT(a)DOMAIN.ORG (aes128-cts-hmac-sha1-96) 4 host/CLIENT(a)DOMAIN.ORG (aes256-cts-hmac-sha1-96) 4 host/CLIENT(a)DOMAIN.ORG (arcfour-hmac) 4 CLIENT$(a)DOMAIN.ORG (des-cbc-crc) 4 CLIENT$(a)DOMAIN.ORG (des-cbc-md5) 4 CLIENT$(a)DOMAIN.ORG (aes128-cts-hmac-sha1-96) 4 CLIENT$(a)DOMAIN.ORG (aes256-cts-hmac-sha1-96) 4 CLIENT$(a)DOMAIN.ORG (arcfour-hmac) ================================================================= root@client:/export/alongina# mount -t nfs4 server.domain.org:/nfs4/server /mnt/server -o sec=krb5 mount.nfs4: access denied by server while mounting server.domain.org:/nfs4/server client: /var/log/syslog eb 11 16:00:39 client rpc.gssd[708]: handling gssd upcall (/run/rpc_pipefs/nfs/clntb) Feb 11 16:00:39 client rpc.gssd[708]: handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' Feb 11 16:00:39 client rpc.gssd[708]: handling krb5 upcall (/run/rpc_pipefs/nfs/clntb) Feb 11 16:00:39 client rpc.gssd[708]: process_krb5_upcall: service is '<null>' Feb 11 16:00:39 client rpc.gssd[708]: Full hostname for 'server.domain.org' is 'server.domain.org' Feb 11 16:00:39 client rpc.gssd[708]: Full hostname for 'client.domain.org' is 'client.domain.org' Feb 11 16:00:39 client rpc.gssd[708]: No key table entry found for CLIENT.DOMAIN.ORG$(a)DOMAIN.ORG while getting keytab entry for &#39;CLIENT.DOMAIN.ORG$(a)DOMAIN.ORG&#39; Feb 11 16:00:39 client rpc.gssd[708]: No key table entry found for root/client.domain.org(a)DOMAIN.ORG while getting keytab entry for &#39;root/client.domain.org(a)DOMAIN.ORG&#39; Feb 11 16:00:39 client rpc.gssd[708]: No key table entry found for nfs/client.domain.org(a)DOMAIN.ORG while getting keytab entry for &#39;nfs/client.domain.org(a)DOMAIN.ORG&#39; Feb 11 16:00:39 client rpc.gssd[708]: Success getting keytab entry for &#39;host/client.domain.org(a)DOMAIN.ORG&#39; Feb 11 16:00:39 client rpc.gssd[708]: WARNING: Client not found in Kerberos database while getting initial ticket for principal &#39;host/client.domain.org(a)DOMAIN.ORG&#39; using keytab 'FILE:/etc/krb5.keytab' Feb 11 16:00:39 client rpc.gssd[708]: ERROR: No credentials found for connection to server server.domain.org Feb 11 16:00:39 client rpc.gssd[708]: doing error downcall Is it mismatch with encryption typs? Problem with DNS ? Client machine is missing reverse addresse in DNS… host client.domain.org client.domain.org has address 10.80.8.54 -------------------- host 10.80.8.54 Host 54.8.80.10.in-addr.arpa. not found: 3(NXDOMAIN) Best longina From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Ondrej Valousek Sent: 30. januar 2014 14:38 To: End-user discussions about the System Security Services Daemon Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount That was me. Yes, autofs works with sssd having AD backend (and using RFC2307 schema). No blushing. ________________________________ From: sssd-users-bounces@lists.fedorahosted.org<mailto:sssd-users-bounces@lists.fedorahosted.org> [sssd-users-bounces(a)lists.fedorahosted.org] on behalf of Chris Gray [fathed(a)gmail.com] Sent: Thursday, January 30, 2014 11:28 AM To: End-user discussions about the System Security Services Daemon Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount This person was able to setup autofs with sssd and samba as their AD server. https://www.mail-archive.com/sssd-users@lists.fedorahosted.org/msg00810.html I haven't tried this, but in theory if you make the right settings in MS AD and in the config files for autofs and sssd, it should work pretty much the same. Since you have to specify where the ou for the automount base is in the autofs config files, you don't actually need to make the automount ou at the base level, but it's up to you and your ad structure on where you want to put it. Then as long as you have krb5, ldap, and everything set right, it should work for Chris On Wed, Jan 29, 2014 at 4:06 AM, Longina Przybyszewska <longina@sdu.dk<mailto:longina@sdu.dk>> wrote: Use case is - we work towards policy, accessing any resources from any platform. All users get per automatic windows share. Additionally, Linux users have primary homedir as nfs mounted share with automount/autofs+ NIs. Some enterprise services have access only to windows share. Linux desktops, running sssd with AD-provider should be able access both shares. Best Longina

Strange, I am always using short hostnames and I did not come across any problems so far. But in general I agree that nfs-utils should handle FQDN hostnames better. Ondrej Odesláno ze Samsung Mobile -------- Původní zpráva -------- Od: Simo Sorce Datum:11. 02. 2014 20:59 (GMT+01:00) Komu: End-user discussions about the System Security Services Daemon Předmět: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem) On Tue, 2014-02-11 at 17:27 +0000, Ondrej Valousek wrote: This normally breaks other things, you should probably instead open a bug against nfs-utils so that they try to split the hostname along '.' before appending the $ I will ping Steve Dickson (mainatiner of nfs-utils) shortly about this, but filing a bug would help anyway. Simo. -- Simo Sorce * Red Hat, Inc * New York _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

Is this because for NFS4 service machine asks, there is need for credentials for machine principal, the one ending with “$”, and rpc.gssd asks about CLIENT.DOMAIN.ORG$@DOMAIN.ORG<mailto:CLIENT.DOMAIN.ORG$@DOMAIN.ORG> instead of CLIENT$(a)DOMAIN.ORG and that question depends on what ‘hostname’ returns? Exactly.

NFs mount works :-) if I change hostname-> shortname('client'). Now I would try to obtain service principal &#39;nfs/client.domain.org(a)DOMAIN.ORG&#39; and try it again with hostname->fqdn(client.domain.org). It is quite logic not have FQDN$ principals in Kerberos (+ long names limit problem) Thanks again for all the enlightment! Best Longina -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of John Hodrien Sent: 12. februar 2014 11:02 To: End-user discussions about the System Security Services Daemon Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem) On Wed, 12 Feb 2014, Longina Przybyszewska wrote: ServicePrincipal vs UserPrincipal. In AD, you can add as many service principals as you like (net ads keytab add blah), but these are only useful for services, as they can't get a Ticket Granting Ticket. NFS is unusual in needing a tgt. So you have ones like host/fqdn which can be used by ssh. You get one user principal for free with AD, which is 'shorthostname$'. That can generate a TGT (i.e. you can use kinit with it). You're allowed one other, which you can generate with samba via 'net ads join createupn='something/fqdn'. This can be useful for services that need it, that don't know to use the other one. So you can use that with nfs to make it all happy that way, by making the nfs/fqdn principal able to request a tgt. hostname should always return the full hostname, and hostname -s should return the short host name. I'd really not change that to fix this problem. jh

On Wed, 12 Feb 2014, Ondrej Valousek wrote: Sure, although if you just roll this out as standard policy for joining machines to the domain, having the nfs/fqdn UPN setup all over the shop won't break anything, and it's a rare requirement to need another UPN for a machine. If you do, there are ways of having even more UPNs for a single host. Personally, I think taking both option 1 *and* 3 is the best solution. jh

On Wed, 12 Feb 2014, Longina Przybyszewska wrote: That's a lot of slashes...? Are you sure? Easiest way to test if it's a UPN is to do: kinit -k nfs/client.domain.org If that works, it's definitely a UPN. I know nothing about realm. With samba, net ads leave should be sufficient I thought. jh

Hi Simo, I are you getting on about this with Steve? Would it be better to open a RFE for this? I would like to know where we are standing - whether there is any chance that RHEL6 will be fixed or it would only go to RHEL 7. Thanks, Ondrej ________________________________________ From: sssd-users-bounces(a)lists.fedorahosted.org [sssd-users-bounces(a)lists.fedorahosted.org] on behalf of Simo Sorce [simo(a)redhat.com] Sent: Tuesday, February 11, 2014 8:59 PM To: End-user discussions about the System Security Services Daemon Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem) On Tue, 2014-02-11 at 17:27 +0000, Ondrej Valousek wrote: This normally breaks other things, you should probably instead open a bug against nfs-utils so that they try to split the hostname along '.' before appending the $ I will ping Steve Dickson (mainatiner of nfs-utils) shortly about this, but filing a bug would help anyway. Simo. -- Simo Sorce * Red Hat, Inc * New York _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

Ok, got it. I will try to write a patch against RH6 (as this is my primary concern :) and will add it to the RFE.. As of RH7: you talked about possibility to use gssproxy to replace rpc.gssd (or was it rpc.svcgssd?). Is it relevant to this problem? Thanks O. Odesláno ze Samsung Mobile -------- Původní zpráva -------- Od: Simo Sorce Datum:19. 02. 2014 19:36 (GMT+01:00) Komu: End-user discussions about the System Security Services Daemon Předmět: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem) On Wed, 2014-02-19 at 15:04 +0000, Ondrej Valousek wrote: This is the current situation: <steved> simo: post a patch with what you want and lets talk about it.... :-) An RFE for RHEL7 would be nice. Simo. -- Simo Sorce * Red Hat, Inc * New York _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users