34.3. Kerberos 인식 NFS 서버 설정

1. 약한 des-cbc-crc 암호화 유형을 활성화하려면 IdM 서버 Kerberos 구성을 업데이트합니다.

   $ ldapmodify -x -D "cn=directory manager" -w password -h ipaserver.example.com -p 389
   
   dn: cn=REALM_NAME,cn=kerberos,dc=example,dc=com
   changetype: modify
   add: krbSupportedEncSaltTypes
   krbSupportedEncSaltTypes: des-cbc-crc:normal
   -
   add: krbSupportedEncSaltTypes
   krbSupportedEncSaltTypes: des-cbc-crc:special
   -
   add: krbDefaultEncSaltTypes
   krbDefaultEncSaltTypes: des-cbc-crc:special

2. NFS 서버에서 NFS 서버의 /etc/krb5.conf 파일에 다음 항목을 추가하면 약한 암호화 지원이 가능합니다.

   allow_weak_crypto = true

[root@nfs-server ~]# kinit admin

[root@nfs-server ~]# ipa service-add nfs/nfs-server.example.com

[root@nfs-server ~]# ipa-getkeytab -s ipaserver.example.com -p nfs/nfs-server.example.com -k /etc/krb5.keytab

[root@nfs-server ~]# ipa service-show nfs/nfs-server.example.com
  Principal name: nfs/nfs-server.example.com@IDM.EXAMPLE.COM
  Principal alias: nfs/nfs-server.example.com@IDM.EXAMPLE.COM
  Keytab: True
  Managed by: nfs-server.example.com

[root@nfs-server ~]# yum install nfs-utils

[root@nfs-server ~] ipa-client-automount
Searching for IPA server...
IPA server: DNS discovery
Location: default
Continue to configure the system with these values? [no]: yes
Configured /etc/sysconfig/nfs
Configured /etc/idmapd.conf
Started rpcidmapd
Started rpcgssd
Restarting sssd, waiting for it to become available.
Started autofs

# systemctl enable nfs-idmapd

/export  *(rw,sec=krb5:krb5i:krb5p)
/home  *(rw,sec=krb5:krb5i:krb5p)

[root@nfs-server ~]# exportfs -rav