When mounting an NFSv4 with Kerberos, authentication fails and krb5kdc.log shows the wrong principal name for the NFS server.
LOOKING_UP_SERVER: ... host/[email protected] for nfs/[email protected] ... Server not found in Kerberos database Principal nfs/containershost.internal.domain.tld should be nfs/nfs.internal.domain.tld.
Am I correct in assuming that a reverse DNS query is being performed which is returning containershost.internal.domain.tld? If so, at what step in the process (and from which machine) does this lookup happen?
$ dig -x 192.111.111.111 111.111.111.192.in-addr.arpa. 6009 IN PTR containershost.internal.domain.tld. Is there a way to prevent this reverse DNS query from happening? The host at IP 192.111.111.111 (containershost.internal.domain.tld) is running multiple containers and so adding PTR records isn't possible.
Docker Container Host
Hostname: containershost.internal.domain.tld
IP: 192.111.111.111
FreeIPA Server (docker)
Image: freeipa/freeipa-server:centos-8-4.8.4
Container Name: freeipa
Container Host: containershost.internal.domain.tld
Hostname: freeipa.internal.domain.tld
IP: 172.222.222.222
Domain: ipa.domain.tld
Realm: IPA.DOMAIN.TLD
Keytab:
$ klist -k /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 host/[email protected] /etc/krb5.conf:
[libdefaults] default_realm = IPA.DOMAIN.TLD dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 [realms] IPA.DOMAIN.TLD = { kdc = freeipa.internal.domain.tld:88 master_kdc = freeipa.internal.domain.tld:88 admin_server = freeipa.internal.domain.tld:749 default_domain = ipa.domain.tld pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem } [domain_realm] .ipa.domain.tld = IPA.DOMAIN.TLD ipa.domain.tld = IPA.DOMAIN.TLD freeipa.internal.domain.tld = IPA.DOMAIN.TLD .internal.domain.tld = IPA.DOMAIN.TLD internal.domain.tld = IPA.DOMAIN.TLD NFS Server (docker)
Image: ubuntu:latest
Container Name: nfs
Container Host: containershost.internal.domain.tld
Hostname: nfs.internal.domain.tld
IP: 172.333.333.333
Running Services:
- /usr/sbin/rpc.mountd --port 32767 --no-nfs-version 2 --no-nfs-version 3 -F --debug all - /usr/sbin/rpc.idmapd -S -vvv -f - /usr/sbin/rpc.nfsd --debug --port 2049 --no-nfs-version 2 --no-nfs-version 3 -L 10 -G 10 - /usr/sbin/rpc.svcgssd -f -vvv -rrr -iii -p nfs/nfs.internal.domain.tld Keytab:
$ klist -k /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 74 host/[email protected] 66 nfs/[email protected] /etc/krb5.conf:
[libdefaults] default_realm = IPA.DOMAIN.TLD dns_lookup_realm = false dns_lookup_kdc = false rdns = false [realms] IPA.DOMAIN.TLD = { kdc = freeipa admin_server = freeipa default_domain = domain.tld } [domain_realm] .domain.tld = IPA.DOMAIN.TLD domain.tld = IPA.DOMAIN.TLD NFS Client
OS: Ubuntu 20.04
Hostname: nfsclient.internal.domain.tld
IP: 192.444.444.444
Keytab:
$ klist -k /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 5 host/[email protected] Mount Command:
$ sudo mount -vvv -t nfs4 -o sec=krb5p 192.111.111.111:/ /mountpoint mount.nfs4: trying text-based options 'sec=krb5,vers=4.2,addr=192.111.111.111,clientaddr=192.444.444.444' mount.nfs4: mount(2): Permission denied mount.nfs4: access denied by server while mounting 192.111.111.111:/ Result
/var/log/krb5kdc.log:
freeipa krb5kdc[288](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23)}) 192.444.444.444: LOOKING_UP_SERVER: authtime 0, etypes {rep=(0)} host/[email protected] for nfs/[email protected], Server not found in Kerberos database 
