XO NFS option sec=krb5p encrypted transport

[Bytevenidos]

Does XO support putting sec=krb5p in the custom mount options field for NFS remotes? Has anyone set this up?

Background on sec=krb5p and what the client needs:
https://man7.org/linux/man-pages/man5/nfs.5.html (Security Considerations)
https://man7.org/linux/man-pages/man8/rpc.gssd.8.html

[poddingue]

I gave this a go on my lab XOA, and XO isn't touching your option at all: the failure quotes the command it ran, mount -o sec=krb5p -t nfs <server>:/path /run/xo-server/mounts/<remote-id>, and a control remote with no custom options mounted the same export fine.

It does fail with mount.nfs: an incorrect mount option was specified, but that line tells you less than it looks like: I fed it sec=totalnonsense and got the identical message back, which is why it reads like XO refusing a valid option when it's really just relaying what mount.nfs said.

The appliance ships rpc.gssd as part of nfs-common, so that part's there. What isn't there is /etc/krb5.keytab or /etc/krb5.conf, and the systemd unit carries ConditionPathExists=/etc/krb5.keytab, so the daemon never starts. Mine last failed that condition at boot eleven days ago and said nothing about it.

I went one step further: dropping a keytab in place is enough for rpc.gssd to start and stay up, so that condition really is the only thing stopping it, and it doesn't need krb5.conf for that. Whether the mount then works needs a KDC and principals that agree with each other, and I couldn't get that far, so that part is still untested.