[36426] in Kerberos
Re: How to use NFS with multiple principals in different realms?
daemon@ATHENA.MIT.EDU (Jurjen Bokma)
Thu Sep 4 11:59:45 2014
Message-ID: <540831FE.1010208@rug.nl>
Date: Thu, 04 Sep 2014 11:33:50 +0200
From: Jurjen Bokma <j.bokma@rug.nl>
MIME-Version: 1.0
To: Cedric Blancher <cedric.blancher@gmail.com>
In-Reply-To: <CALXu0Ue9z-xbFk9hhsvu4c38qqmd0Wwupk2LvL99rwoAcRMqOw@mail.gmail.com>
Cc: Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
"<kerberos@mit.edu>" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
You use cross realm authentication, so that your NFS client may obtain
tickets for servers that are not in its own realm.
To allow for cross-realm authentication from your own MYREALM.NET (where
te client is) to your neighbour's HISREALM.ORG (the realm of the
server), you basically create *in*each*realm* a principal
krbtgt/MYREALM.NET@HISREALM.ORG.
Both principals must be identical. They have to have the same name, the
same encryption types, and the same kvno.
After that, it's a matter of configuring the krb5.conf right: tell the
Kerberos servers which machine is in which realm if DNS doesn't do that.
Debian bug #571244 may also come into play on RHEL?
I've got step by step documentation for an Ubuntu NFS client with
Kerberos served by Heimdal under Debian and Windows AD respectively. But
I haven't anonymized the text yet, so I can't put it online immediately.
Would it help you if I anonymize it soon, or can you work it our from
just the above hints?
Regards
Jurjen
On 09/04/2014 11:04 AM, Cedric Blancher wrote:
> How can I use NFS with kerberos krb5p auth when I want to use NFS
> filesystems which come from different realms?
>
> I know klist -A can show all tickets I got from all realms I kinit to
> - but how can NFS use them?
>
> OS is RHEL7
>
> Ced
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
