Home / server / Questions / 376762
In Process
Kendall Hopkins
Asked: 2012-04-05 10:13:56 +0800 CST

NFS (with Kerberos) mount failing due to "Server not found in Kerberos database" error

  • 772

When running:

sudo mount -t nfs4 -o sec=krb5 sol.domain.com:/ /mnt

I get this error on the client:

mount.nfs4: access denied by server while mounting sol.domain.com:/

And on the server syslogs I read

UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for nfs/ip-#-#-#-#[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for nfs/ip-#-#-#-#[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database
UNKNOWN_SERVER: authtime 0,  nfs/[email protected] for krbtgt/[email protected], Server not found in Kerberos database

Server keytab file:

ubuntu@sol:~$ sudo klist -e -k /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   7 host/[email protected] (aes256-cts-hmac-sha1-96) 
   7 host/[email protected] (arcfour-hmac) 
   7 host/[email protected] (des3-cbc-sha1) 
   7 host/[email protected] (des-cbc-crc) 
   9 nfs/[email protected] (aes256-cts-hmac-sha1-96) 
   9 nfs/[email protected] (arcfour-hmac) 
   9 nfs/[email protected] (des3-cbc-sha1) 
   9 nfs/[email protected] (des-cbc-crc)

Client keytab file: 

ubuntu@mercury:~$ sudo klist -e -k /etc/krb5.keytab
Keytab name: WRFILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 host/[email protected] (aes256-cts-hmac-sha1-96) 
   3 host/[email protected] (arcfour-hmac) 
   3 host/[email protected] (des3-cbc-sha1) 
   3 host/[email protected] (des-cbc-crc) 
   3 nfs/[email protected] (aes256-cts-hmac-sha1-96) 
   3 nfs/[email protected] (arcfour-hmac) 
   3 nfs/[email protected] (des3-cbc-sha1) 
   3 nfs/[email protected] (des-cbc-crc)
nfs mount amazon-ec2 kerberos

1 Answers

  1. It seems that the reverse name resolution for the IP is not matching the name you are expecting. Make sure that mercury.domain.com and sol.domain.com are the first name that you added to /etc/hosts after the relevant IP address. To be safe, just add a couple of lines on the top with the IP address of the machine and the hostname that kerberos expects.

    10.x.y.z sol.domain.com sol ip-blah-blah
10.a.b.c mercury.domain.com mercury ip-other-other

    Make sure that both of these lines are present on both the client and the server.

    It is also a good idea verify the setup by running the following command on both the client and the server. Make sure that the first hostname printed for each IP address is the one you are expecting.

    getent hosts 10.x.y.z 10.a.b.c
    • 1