Kerberos NFS Notes

These are my notes on things I shouldn't forget, but apparently have since last time I used kerberos.

• You can use kinit user@DOMAIN to get a credential in another domain.

• The version of nfsv4/kerberos server in the kernel <3.11 is broken.

• Setting up exports:

  /export \*(ro,sync,insecure,sec=krb5p)

  This means the entire internet can connect to your nfs server(*), on any tcp port (insecure), but only if the connection is inencrypted with kerberos (sec=krb5p).

  This will export a filesystem with a top level directory "/export" in it.

• Add "_nfs4._tcp.DOMAIN IN SRV 0 0 nfsserver.DOMAIN" to DNS.

• On the client install autofs, and create a file /etc/auto.master.d/nfs4.autofs with the contents:

  /srv/nfs4 /etc/auto.nfs4

• And create an executable script called /etc/auto.nfs4 with the contents:

  #!/bin/sh

  DOMAIN=$1

  dig +short nfs4.tcp.$1 srv | awk -v domain=$1 '{ printf "-fstype=nfs4\\n %s:/\n",$4 }'

• Make sure you have a keytab on your client. (I forget how to do this)

• cd /srv/nfs4/domain/export/ should now contain your files.