Project

General

Profile

action #25704

Use kerberos authentication for nfs shares

Added by ingogoeppert about 4 years ago. Updated about 1 month ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
-
Target version:
Start date:
2017-10-01
Due date:
% Done:

100%

Estimated time:

Description

To improve security when nfs shares are used, we should use kerberos authentication.

Needs:

  • Modified share configuration
  • SPNs
  • Modified client configuration

Links:

Current state:

  • invis Server 14 setup is prepared for kerberos, but exports are still without
  • membermod adds the spn we need for kerberos (execute manual)
  • client setup is prepared for kerberos. Todo: Exporting the additional spn to the client keytab after the join (or do it manual).

Export keytab on the client: "net ads keytab create" or "net ads keytab create -P"

nfs-kerberos (2.05 KB) nfs-kerberos ingogoeppert, 2018-07-15 20:27

History

#1 Updated by ingogoeppert about 4 years ago

  • Description updated (diff)

#2 Updated by ingogoeppert almost 4 years ago

  • Category changed from 364 to Developement

#3 Updated by ingogoeppert over 3 years ago

  • Project changed from invis-server to invisAD-setup
  • Category deleted (Developement)
  • Target version deleted (Next)

#4 Updated by flacco over 3 years ago

  • Target version set to Future

#5 Updated by flacco over 3 years ago

  • Assignee set to ingogoeppert

#6 Updated by ingogoeppert over 3 years ago

First setup was successful. Steps to modify a classic nfs setup to a kerberos setup are described in German in the attached document. Test setup was a invis 15 Server and a openSUSE Leap 42.3 Client with KDE Desktop. Both VirtualBox VMs.

#7 Updated by ingogoeppert over 3 years ago

  • Private changed from Yes to No

#8 Updated by ingogoeppert about 3 years ago

  • Description updated (diff)

#9 Updated by ingogoeppert about 3 years ago

Tests at FrOSCon 13 failed with "permission denied". Very strange: after restarting sssd in the running system it succeeds. It also happened at my test setup. We have to find out why before we roll out nfs with kerberos as default or reconfigure systems to nfs with kerberos.

#10 Updated by ingogoeppert about 3 years ago

  • Description updated (diff)

#11 Updated by ingogoeppert about 3 years ago

  • Description updated (diff)

#12 Updated by flacco almost 3 years ago

File /etc/sysconfig/nfs did not contain the variable NFS_SECURITY_GSS in openSUSE leap 15.0. We have to investigate this.

#13 Updated by ingogoeppert 2 months ago

  • Status changed from In Progress to Closed
  • Target version changed from Future to 14.2

First steps done, was not used in production setups until now.

#14 Updated by ingogoeppert about 1 month ago

  • % Done changed from 30 to 100

Also available in: Atom PDF