XCP-ng
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    XO NFS option sec=krb5p encrypted transport

    Scheduled Pinned Locked Moved Xen Orchestra
    3 Posts 2 Posters 56 Views 2 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BytevenidosB Offline
      Bytevenidos
      last edited by

      Does XO support putting sec=krb5p in the custom mount options field for NFS remotes? Has anyone set this up?

      Background on sec=krb5p and what the client needs:
      https://man7.org/linux/man-pages/man5/nfs.5.html (Security Considerations)
      https://man7.org/linux/man-pages/man8/rpc.gssd.8.html

      poddingueP 1 Reply Last reply Reply Quote 0
      • poddingueP Online
        poddingue Vates 🪐 @Bytevenidos
        last edited by

        I gave this a go on my lab XOA, and XO isn't touching your option at all: the failure quotes the command it ran, mount -o sec=krb5p -t nfs <server>:/path /run/xo-server/mounts/<remote-id>, and a control remote with no custom options mounted the same export fine. 🤷

        It does fail with mount.nfs: an incorrect mount option was specified, but that line tells you less than it looks like: I fed it sec=totalnonsense and got the identical message back, which is why it reads like XO refusing a valid option when it's really just relaying what mount.nfs said.

        The appliance ships rpc.gssd as part of nfs-common, so that part's there. What isn't there is /etc/krb5.keytab or /etc/krb5.conf, and the systemd unit carries ConditionPathExists=/etc/krb5.keytab, so the daemon never starts. Mine last failed that condition at boot eleven days ago and said nothing about it.

        I went one step further: dropping a keytab in place is enough for rpc.gssd to start and stay up, so that condition really is the only thing stopping it, and it doesn't need krb5.conf for that. Whether the mount then works needs a KDC and principals that agree with each other, and I couldn't get that far, so that part is still untested. 🤔

        BytevenidosB 1 Reply Last reply Reply Quote 0
        • BytevenidosB Offline
          Bytevenidos @poddingue
          last edited by Bytevenidos

          I do have active directory setup in my lab environment. I just need to set aside some time to try it out between two domain joined hosts.

          Thanks for trying that! That's some good debugging.

          1 Reply Last reply Reply Quote 0

          Hello! It looks like you're interested in this conversation, but you don't have an account yet.

          Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.

          With your input, this post could be even better 💗

          Register Login
          • First post
            Last post