我有以下nfs导出：
/home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) 当试图挂载到客户端时，我得到：
client:/home # mount -t nfs4 -o sec=krb5p server:/home/users /home/users -vvv mount.nfs4: timeout set for Sun May 12 21:13:56 2013 mount.nfs4: trying text-based options 'sec=krb5p,addr=192.168.1.2,clientaddr=192.168.1.62' mount.nfs4: mount(2): Permission denied mount.nfs4: access denied by server while mounting server:/home/users
在服务器syslog我得到：
May 12 19:59:48 server krb5kdc[2704]: AS_REQ (4 etypes {18 17 16 23}) 192.168.1.62: NEEDED_PREAUTH: nfs/client.localdomain@REALM for krbtgt/REALM@REALM, Additional pre-authentication required May 12 19:59:48 server krb5kdc[2704]: preauth (encrypted_timestamp) verify failure: Decrypt integrity check failed May 12 19:59:48 server krb5kdc[2704]: AS_REQ (4 etypes {18 17 16 23}) 192.168.1.62: PREAUTH_FAILED: nfs/client.localdomain@REALM for krbtgt/REALM@REALM, Decrypt integrity check failed
据我可以告诉keytabs已被正确设置：
客户：
client:/home # ktutil ktutil: rkt /etc/krb5.keytab ktutil: list slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 4 nfs/client.localdomain@REALM 2 4 nfs/client.localdomain@REALM 3 4 nfs/client.localdomain@REALM 4 4 nfs/client.localdomain@REALM 5 4 host/client.localdomain@REALM 6 4 host/client.localdomain@REALM 7 4 host/client.localdomain@REALM 8 4 host/client.localdomain@REALM
服务器：
root@server:~# ktutil ktutil: rkt /etc/krb5.keytab ktutil: list slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 3 host/server.localdomain@REALM 2 3 host/server.localdomain@REALM 3 3 host/server.localdomain@REALM 4 3 host/server.localdomain@REALM 5 2 cifs/server.localdomain@REALM 6 2 HTTP/server.localdomain@REALM 7 2 HTTP/server.localdomain@REALM 8 2 HTTP/server.localdomain@REALM 9 2 HTTP/server.localdomain@REALM 10 2 nfs/server.localdomain@REALM 11 2 nfs/server.localdomain@REALM 12 2 nfs/server.localdomain@REALM 13 2 nfs/server.localdomain@REALM
在客户端使用kinit进行Kerberos用户身份validation可以正常工作。
当我尝试在服务器本身上安装相同的nfs时，它会成功。
什么是预authentication，以及预authentication失败的可能原因是什么？
原来，重新生成客户端密钥表以某种方式解决了这个问题。