Project

General

Profile

action #25704

Use kerberos authentication for nfs shares

Added by ingogoeppert almost 4 years ago. Updated over 2 years ago.

Status:
In Progress
Priority:
Normal
Assignee:
Category:
-
Target version:
Start date:
2017-10-01
Due date:
% Done:

30%

Estimated time:

Description

To improve security when nfs shares are used, we should use kerberos authentication.

Needs:

  • Modified share configuration
  • SPNs
  • Modified client configuration

Links:

Current state:

  • invis Server 14 setup is prepared for kerberos, but exports are still without
  • membermod adds the spn we need for kerberos (execute manual)
  • client setup is prepared for kerberos. Todo: Exporting the additional spn to the client keytab after the join (or do it manual).

Export keytab on the client: "net ads keytab create" or "net ads keytab create -P"

nfs-kerberos (2.05 KB) nfs-kerberos ingogoeppert, 2018-07-15 20:27

History

#1 Updated by ingogoeppert almost 4 years ago

  • Description updated (diff)

#2 Updated by ingogoeppert over 3 years ago

  • Category changed from 364 to Developement

#3 Updated by ingogoeppert over 3 years ago

  • Project changed from invis-server to invisAD-setup
  • Category deleted (Developement)
  • Target version deleted (Next)

#4 Updated by flacco over 3 years ago

  • Target version set to Future

#5 Updated by flacco over 3 years ago

  • Assignee set to ingogoeppert

#6 Updated by ingogoeppert about 3 years ago

First setup was successful. Steps to modify a classic nfs setup to a kerberos setup are described in German in the attached document. Test setup was a invis 15 Server and a openSUSE Leap 42.3 Client with KDE Desktop. Both VirtualBox VMs.

#7 Updated by ingogoeppert about 3 years ago

  • Private changed from Yes to No

#8 Updated by ingogoeppert almost 3 years ago

  • Description updated (diff)

#9 Updated by ingogoeppert almost 3 years ago

Tests at FrOSCon 13 failed with "permission denied". Very strange: after restarting sssd in the running system it succeeds. It also happened at my test setup. We have to find out why before we roll out nfs with kerberos as default or reconfigure systems to nfs with kerberos.

#10 Updated by ingogoeppert almost 3 years ago

  • Description updated (diff)

#11 Updated by ingogoeppert almost 3 years ago

  • Description updated (diff)

#12 Updated by flacco over 2 years ago

File /etc/sysconfig/nfs did not contain the variable NFS_SECURITY_GSS in openSUSE leap 15.0. We have to investigate this.

Also available in: Atom PDF