Zugriff auf einen freigegebenen NFSv4-Ordner mit Kerberos-Authentifizierung ohne Root-Rechte

Ich habe einen freigegebenen NFSv4-Ordner mit Kerberos-Authentifizierung eingerichtet. Das Problem, mit dem ich konfrontiert bin, ist, dass der Benutzer auf dem Client-Computer mount /mnt(siehe die fstab-Konfiguration unten) nicht auf das Verzeichnis / mnt zugreifen kann. Ich denke, das liegt an den Rechten am Kerberos-Ticket. In der Tat bekomme ich nur ein Ticket, das root gehört.

Auf Client = 192.168.1.2 und Server = 192.168.1.1 wird Ubuntu 18.04.1 ausgeführt

Hier die Befehlszeilen:

user@client:~$ mount -vvv /mnt mount.nfs4: timeout set for Mon Sep 10 16:55:58 2018 mount.nfs4: trying text-based options 'proto=tcp,port=2049,sec=krb5p,vers=4.2,addr=192.168.1.1,clientaddr=192.168.1.2'  user@client:~$ cd /mnt bash: cd: /mnt: Permission denied  user@client:~$ ll /tmp/krb5ccmachine_DOMAIN.FR  -rw------- 1 root root 1628 sept. 10 16:53 /tmp/krb5ccmachine_DOMAIN.FR  user@client:~$ sudo klist -c /tmp/krb5ccmachine_DOMAIN.FR  Ticket cache: FILE:/tmp/krb5ccmachine_DOMAIN.FR Default principal: nfs/client.domain.fr@DOMAIN.FR  Valid starting Expires Service principal 10/09/2018 16:53:42 11/09/2018 02:53:42 krbtgt/DOMAIN.FR@DOMAIN.FR renew until 11/09/2018 16:53:42 10/09/2018 16:53:42 11/09/2018 02:53:42 nfs/server.domain.fr@ renew until 11/09/2018 16:53:42 10/09/2018 16:53:42 11/09/2018 02:53:42 nfs/server.domain.fr@DOMAIN.FR renew until 11/09/2018 16:53:42  root@client:~# klist -k /etc/krb5.keytab  Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 3 nfs/client.domain.fr@DOMAIN.FR 3 nfs/client.domain.fr@DOMAIN.FR 

Ich habe festgestellt, dass wenn ich ein "kinit" von nfs / client.domain.fr mit Benutzerrechten mache und dann den mount-Befehl ausführt, ich auf das Verzeichnis / mnt zugreifen kann

user@client:~$ kinit nfs/client.domain.fr -t Documents/krb5.keytab  keytab specified, forcing -k user@client:~$ klist  Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: nfs/client.domain.fr@DOMAIN.FR  Valid starting Expires Service principal 10/09/2018 17:22:59 11/09/2018 03:22:59 krbtgt/DOMAIN.FR@DOMAIN.FR renew until 11/09/2018 17:22:59  user@client:~$ mount /mnt user@client:~$ cd /mnt user@client:/mnt$ ll total 12 drwxrwxrwx 3 root root 4096 sept. 4 10:30 ./ drwxr-xr-x 24 root root 4096 sept. 4 11:09 ../ drwxrwxrwx 2 root root 4096 sept. 10 16:14 media/  user@client:/mnt$ ll /tmp/krb5cc* -rw------- 1 user user 2037 sept. 10 17:23 /tmp/krb5cc_1000 -rw------- 1 root root 1628 sept. 10 17:23 /tmp/krb5ccmachine_DOMAIN.FR  user@client:/mnt$ sudo klist /tmp/krb5ccmachine_DOMAIN.FR  [sudo] Mot de passe de user :  Ticket cache: FILE:/tmp/krb5ccmachine_DOMAIN.FR Default principal: nfs/client.domain.fr@DOMAIN.FR  Valid starting Expires Service principal 10/09/2018 17:23:35 11/09/2018 03:23:35 krbtgt/DOMAIN.FR@DOMAIN.FR renew until 11/09/2018 17:23:35 10/09/2018 17:23:35 11/09/2018 03:23:35 nfs/server.domain.fr@ renew until 11/09/2018 17:23:35 10/09/2018 17:23:35 11/09/2018 03:23:35 nfs/server.domain.fr@DOMAIN.FR renew until 11/09/2018 17:23:35 

Meine Konfigurationsdateien:

/ etc / fstab auf dem Client-Rechner

# /etc/fstab: static file system information. # # Use 'blkid' to print the universally unique identifier for a # device; this may be used with UUID= as a more robust way to name devices # that works even if disks are added and removed. See fstab(5). # # <file system> <mount point> <type> <options> <dump> <pass> # / was on /dev/sda1 during installation UUID=14d26733-1eb1-4c23-b6eb-7be5564675a6 / ext4 errors=remount-ro 0 1 /swapfile none swap sw 0 0 server:/ /mnt nfs4 proto=tcp,port=2049,sec=krb5p,noauto,user 0 0 

/ etc / fstab auf dem Server:

# /etc/fstab: static file system information. # # Use 'blkid' to print the universally unique identifier for a # device; this may be used with UUID= as a more robust way to name devices # that works even if disks are added and removed. See fstab(5). # # <file system> <mount point> <type> <options> <dump> <pass> # / was on /dev/sda1 during installation UUID=6edf6c8d-be74-4908-91c4-4c7bb453bc76 / ext4 errors=remount-ro 0 1 /swapfile none swap sw 0 0 /home/media /export/media none bind 0 0 

/ etc / exports auf dem Server:

# /etc/exports: the access control list for filesystems which may be exported # to NFS clients. See exports(5). # # Example for NFSv2 and NFSv3: # /srv/homes hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check) # # Example for NFSv4: # /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check) # /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check) # /export 192.168.1.0/24(rw,fsid=0,no_subtree_check,sync,sec=krb5p,all_squash,anonuid=1000,anongid=1000) /export/media 192.168.1.0/24(rw,nohide,insecure,no_subtree_check,sync,sec=krb5p,all_squash,anonuid=1000,anongid=1000) 

Benutzer mit uid = 1000 und gid = 1000 ist auf Client und Server vorhanden. Ich habe es auch mit der root_squash-Option versucht.

/etc/krb5.conf auf Client und Server:

[logging] default = FILE:/tmp/krb5libs.log kdc = FILE:/tmp/krb5kdc.log admin_server = FILE:/tmp/kadmind.log  [libdefaults] default_realm = DOMAIN.FR  # The following krb5.conf variables are only for MIT Kerberos. kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true  # The following encryption type specification will be used by MIT Kerberos # if uncommented. In general, the defaults in the MIT Kerberos code are # correct and overriding these specifications only serves to disable new # encryption types as they are added, creating interoperability problems. # # The only time when you might need to uncomment these lines and change # the enctypes is if you have local software that will break on ticket # caches containing ticket encryption types it doesn't know about (such as # old versions of Sun Java).  # default_tgs_enctypes = des3-hmac-sha1 # default_tkt_enctypes = des3-hmac-sha1 # permitted_enctypes = des3-hmac-sha1  # The following libdefaults parameters are only for Heimdal Kerberos. fcc-mit-ticketflags = true  [realms] DOMAIN.FR = { kdc = kdc.domain.fr admin_server = kerberos.domain.fr default_domain = domain.fr }  [domain_realm] .domain.fr = DOMAIN.FR domain.fr = DOMAIN.FR 

/ etc / default / nfs-kernel-server auf dem server:

# Number of servers to start up RPCNFSDCOUNT=8  # Runtime priority of server (see nice(1)) RPCNFSDPRIORITY=0  # Options for rpc.mountd. # If you have a port-based firewall, you might want to set up # a fixed port here using the --port option. For more information,  # see rpc.mountd(8) or http://wiki.debian.org/SecuringNFS # To disable NFSv4 on the server, specify '--no-nfs-version 4' here RPCMOUNTDOPTS="--manage-gids --debug all"  # Do you want to start the svcgssd daemon? It is only required for Kerberos # exports. Valid alternatives are "yes" and "no"; the default is "no". NEED_SVCGSSD="yes"  # Options for rpc.svcgssd. RPCSVCGSSDOPTS="-vvv" 

/ etc / default / nfs-common auf Client und Server:

# If you do not set values for the NEED_ options, they will be attempted # autodetected; this should be sufficient for most people. Valid alternatives # for the NEED_ options are "yes" and "no".   # Options for rpc.statd. # Should rpc.statd listen on a specific port? This is especially useful # when you have a port-based firewall. To use a fixed port, set this # this variable to a statd argument like: "--port 4000 --outgoing-port 4001". # For more information, see rpc.statd(8) or http://wiki.debian.org/SecuringNFS STATDOPTS=  # Do you want to start the gssd daemon? It is required for Kerberos mounts. NEED_GSSD=yes 

/ etc / hosts auf Client und Server:

127.0.0.1 localhost  # server 192.168.1.1 server.domain.fr server 192.168.1.1 domain.fr # Client 192.168.1.2 client.domain.fr client 

Protokolle von kdc:

sept. 10 16:48:06 server krb5kdc[545](info): setting up network... krb5kdc: setsockopt(10,IPV6_V6ONLY,1) worked krb5kdc: setsockopt(12,IPV6_V6ONLY,1) worked krb5kdc: setsockopt(14,IPV6_V6ONLY,1) worked sept. 10 16:48:06 server krb5kdc[545](info): set up 6 sockets sept. 10 16:48:06 server krb5kdc[572](info): commencing operation sept. 10 16:53:42 server krb5kdc[572](info): AS_REQ (8 etypes ) 192.168.1.2: NEEDED_PREAUTH: nfs/client.domain.fr@DOMAIN.FR for krbtgt/DOMAIN.FR@DOMAIN.FR, Additional pre-authentication required sept. 10 16:53:42 server krb5kdc[572](info): AS_REQ (8 etypes ) 192.168.1.2: ISSUE: authtime 1536591222, etypes, nfs/client.domain.fr@DOMAIN.FR for krbtgt/DOMAIN.FR@DOMAIN.FR sept. 10 16:53:42 server krb5kdc[572](info): TGS_REQ (8 etypes ) 192.168.1.2: ISSUE: authtime 1536591222, etypes, nfs/client.domain.fr@DOMAIN.FR for nfs/server.domain.fr@DOMAIN.FR 

Jetzt kann ich nur den freigegebenen Ordner mounten und mit root-Benutzer auf dem Client-Computer darauf zugreifen, da das Ticket, das ich bekomme, root gehört. Kann man ein Ticket bekommen, das dem Benutzer gehört? Ich würde gerne wissen, ob es möglich ist, das freigegebene Verzeichnis mit dem Benutzer zu mounten und darauf zuzugreifen, ohne vorher das kinit zu machen.

Wenn Sie weitere Informationen benötigen oder Fragen zu meiner Konfiguration haben, zögern Sie nicht.