2.11. Setting up an NFS server with Kerberos in a Red Hat Enterprise Linux Identity Management domain

Procedure

1. Obtain a kerberos ticket as an IdM administrator:

   # kinit admin

2. Create a nfs/<FQDN> service principal:

   # ipa service-add nfs/nfs_server.idm.example.com

3. Retrieve the nfs service principal from IdM, and store it in the /etc/krb5.keytab file:

   # ipa-getkeytab -s idm_server.idm.example.com -p nfs/nfs_server.idm.example.com -k /etc/krb5.keytab

4. Optional: Display the principals in the /etc/krb5.keytab file:

   # klist -k /etc/krb5.keytab
   Keytab name: FILE:/etc/krb5.keytab
   KVNO Principal
   ---- --------------------------------------------------------------------------
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM

   By default, the IdM client adds the host principal to the /etc/krb5.keytab file when you join the host to the IdM domain. If the host principal is missing, use the ipa-getkeytab -s idm_server.idm.example.com -p host/nfs_server.idm.example.com -k /etc/krb5.keytab command to add it.

5. Use the ipa-client-automount utility to configure mapping of IdM IDs:

   #  ipa-client-automount
   Searching for IPA server...
   IPA server: DNS discovery
   Location: default
   Continue to configure the system with these values? [no]: yes
   Configured /etc/idmapd.conf
   Restarting sssd, waiting for it to become available.
   Started autofs

6. Update your /etc/exports file, and add the Kerberos security method to the client options. For example:

   /nfs/projects/      	192.0.2.0/24(rw,sec=krb5i)

   If you want that your clients can select from multiple security methods, specify them separated by colons:

   /nfs/projects/      	192.0.2.0/24(rw,sec=krb5:krb5i:krb5p)

7. Reload the exported file systems:

   # exportfs -r