When mounting an NFSv4 with Kerberos, authentication fails and krb5kdc.log shows the wrong principal name for the NFS server.
LOOKING_UP_SERVER: ... host/[email protected] for nfs/[email protected]
... Server not found in Kerberos database
Principal nfs/containershost.internal.domain.tld should be nfs/nfs.internal.domain.tld.
Am I correct in assuming that a reverse DNS query is being performed which is returning containershost.internal.domain.tld? If so, at what step in the process (and from which machine) does this lookup happen?
$ dig -x 192.111.111.111
111.111.111.192.in-addr.arpa. 6009 IN PTR containershost.internal.domain.tld.
Is there a way to prevent this reverse DNS query from happening? The host at IP 192.111.111.111 (containershost.internal.domain.tld) is running multiple containers and so adding PTR records isn't possible.
Docker Container Host
Hostname: containershost.internal.domain.tld
IP: 192.111.111.111
FreeIPA Server (docker)
Image: freeipa/freeipa-server:centos-8-4.8.4
Container Name: freeipa
Container Host: containershost.internal.domain.tld
Hostname: freeipa.internal.domain.tld
IP: 172.222.222.222
Domain: ipa.domain.tld
Realm: IPA.DOMAIN.TLD
Keytab:
$ klist -k /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
2 host/[email protected]
/etc/krb5.conf:
[libdefaults]
default_realm = IPA.DOMAIN.TLD
dns_lookup_realm = false
dns_lookup_kdc = true
rdns = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
[realms]
IPA.DOMAIN.TLD = {
kdc = freeipa.internal.domain.tld:88
master_kdc = freeipa.internal.domain.tld:88
admin_server = freeipa.internal.domain.tld:749
default_domain = ipa.domain.tld
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.ipa.domain.tld = IPA.DOMAIN.TLD
ipa.domain.tld = IPA.DOMAIN.TLD
freeipa.internal.domain.tld = IPA.DOMAIN.TLD
.internal.domain.tld = IPA.DOMAIN.TLD
internal.domain.tld = IPA.DOMAIN.TLD
NFS Server (docker)
Image: ubuntu:latest
Container Name: nfs
Container Host: containershost.internal.domain.tld
Hostname: nfs.internal.domain.tld
IP: 172.333.333.333
Running Services:
- /usr/sbin/rpc.mountd --port 32767 --no-nfs-version 2 --no-nfs-version 3 -F --debug all
- /usr/sbin/rpc.idmapd -S -vvv -f
- /usr/sbin/rpc.nfsd --debug --port 2049 --no-nfs-version 2 --no-nfs-version 3 -L 10 -G 10
- /usr/sbin/rpc.svcgssd -f -vvv -rrr -iii -p nfs/nfs.internal.domain.tld
Keytab:
$ klist -k /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
74 host/[email protected]
66 nfs/[email protected]
/etc/krb5.conf:
[libdefaults]
default_realm = IPA.DOMAIN.TLD
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
[realms]
IPA.DOMAIN.TLD = {
kdc = freeipa
admin_server = freeipa
default_domain = domain.tld
}
[domain_realm]
.domain.tld = IPA.DOMAIN.TLD
domain.tld = IPA.DOMAIN.TLD
NFS Client
OS: Ubuntu 20.04
Hostname: nfsclient.internal.domain.tld
IP: 192.444.444.444
Keytab:
$ klist -k /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
5 host/[email protected]
Mount Command:
$ sudo mount -vvv -t nfs4 -o sec=krb5p 192.111.111.111:/ /mountpoint
mount.nfs4: trying text-based options 'sec=krb5,vers=4.2,addr=192.111.111.111,clientaddr=192.444.444.444'
mount.nfs4: mount(2): Permission denied
mount.nfs4: access denied by server while mounting 192.111.111.111:/
Result
/var/log/krb5kdc.log:
freeipa krb5kdc[288](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17),
DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23)}) 192.444.444.444: LOOKING_UP_SERVER: authtime 0,
etypes {rep=(0)} host/[email protected] for nfs/[email protected],
Server not found in Kerberos database