我有nfsserver和nfsclient机器。
在nfsserver上:
# cat /etc/exports /export gss/krb5p(rw,sync,fsid=0,no_subtree_check,crossmnt) /export/home gss/krb5p(rw,sync,no_subtree_check)
在nfsclient上挂载OK:
# mount -vvv -t nfs4 -o sec=krb5p nfsserver:/home /homex mount: fstab path: "/etc/fstab" mount: mtab path: "/etc/mtab" mount: lock path: "/etc/mtab~" mount: temp path: "/etc/mtab.tmp" mount: UID: 0 mount: eUID: 0 mount: spec: "nfsserver:/home" mount: node: "/homex" mount: types: "nfs4" mount: opts: "sec=krb5p" mount: external mount: argv[0] = "/sbin/mount.nfs4" mount: external mount: argv[1] = "nfsserver:/home" mount: external mount: argv[2] = "/homex" mount: external mount: argv[3] = "-v" mount: external mount: argv[4] = "-o" mount: external mount: argv[5] = "rw,sec=krb5p" mount.nfs4: timeout set for Tue Apr 30 13:03:13 2013 mount.nfs4: trying text-based options 'sec=krb5p,addr=10.10.10.100,clientaddr=10.10.10.101' nfsserver:/home on /homex type nfs4 (rw,sec=krb5p)
但是我只能以root身份访问这个目录。 普通用户得到:
$ ls /homex ls: cannot access /homex: Permission denied $ df /homex df: `/homex': Permission denied df: no file systems processed
我用rpcdebug打开了所有的NFSdebugging(nfsserver,nfsclient),但在正常用户尝试访问挂载的目录期间,我在nfsclient上看到的唯一一件事是:
Apr 30 12:51:19 nfsclient kernel: [ 5896.339330] NFS: permission(0:13/917551), mask=0x24, res=-13 Apr 30 12:51:32 nfsclient kernel: [ 5909.182185] NFS: revalidating (0:13/917551) Apr 30 12:51:32 nfsclient kernel: [ 5909.189372] nfs_revalidate_inode: (0:13/917551) getattr failed, error=-13
在nfsserver上没有任何东西(甚至在用tcpdump嗅探时没有networkingstream量)。
文件权限似乎是确定的:
# ls -ld /homex drwxr-xr-x 3 root root 4096 Apr 5 18:15 /homex # ls -l /homex total 4 drwxr-xr-x 6 mike mike 4096 Apr 29 13:48 mike # df /homex Filesystem 1K-blocks Used Available Use% Mounted on nfsserver:/home 20640384 1390208 18201600 8% /homex
用户麦克在两台机器上都有相同的UID。
Kerberized NFS(任何gss )需要Kerberos票据。 如果要使用无门票访问NFS,则必须使用不太安全的sys安全级别。
通过使用sssd或者pam_krb5作为你的一部分,或者通过ssh的证书委托( GSSAPIAuthentication yes和GSSAPIDelegateCredentials ),可以让用户获得票据。
因此,用户可以在使用kinit获取Kerberos票据后访问NFS挂接。
但是如何让用户在没有票证的情况下访问NFS挂载?