Can't get NFSv4/kerberos to work
As detailed here:
I also could not get NFSv4/kerberos to work with either FreeBSD 9.3 or Linux (CentOS 7) clients.
I found a solution, probably not THE solution, but a solution. Also note that I was focusing solely on NFSv4 so this certainly may break something else.
Here are the three steps I took to make it work.
In /etc/hosts comment out:
127.0.0.1 freenas freenas.example.com
This allows nfsd to register with gssd.
Change /etc/exports from:
V4: / /mnt/pool/test_krb5 -sec=krb5:krb5i:krb5p
V4: / -sec=krb5:krb5i:krb5p /mnt/pool/test_krb5 -sec=krb5:krb5i:krb5p
This allows SETCLIENTID opcodes to proceed.
At a root prompt:
service gssd stop service nfsd stop service mountd stop service gssd start service nfsd start (this will also start mountd)
Mounts from both FreBSD and CentOS 7 now work, however the very first write to a file hangs for roughly 60 seconds. Certainly may be a config issue that I haven't discovered. However everything seems to work as expected on subsequent reads/writes.
Oh and this was seen in FreeNAS-9.3-STABLE-201501301837 however that wasn't an option in the dropdown (yet).
#5 Updated by Josh Paetzel over 5 years ago
Ok, I can see right now this is going to require some fairly major refactoring. The whole "NFSv4" checkbox in services -> NFS will need to go away. Instead there will need to be an NFSv4 share created.
A file called ix-nfsd creates /etc/exports. I've attached a cooked version of it, could you try installing it to /conf/base/etc/ix.rcd/ix-nfsd on your system and rebooting? The desired outcome is working NFSv4 after a reboot. (I think it should work, /etc/exports will get generated correctly before gssd or nfsd are started, so those shouldn't need to get restarted, and I think the /etc/hosts change is a red herring)
#7 Updated by Eric Bledsoe over 5 years ago
That did create the correct /etc/exports file. After fixing /etc/hosts mounts work as expected.
The change to /etc/hosts is absolutely NOT a red herring, at least in my environment (may not be needed if the KDC is running on the FreeNAS box?). With that line left in both v3 or v4 krb5(x) mounts do NOT work. I found that by truss'ing either nfsd or gssd or both, can't remember for sure. When I saw that it opened /etc/hosts while nfsd was starting up I realized what was happening, at least partially. Also when the line is left uncommented in /etc/hosts on the console I see "nfsd: can't register svc name" when nfsd is starting.
I didn't think I had "All Directories" checked, it is now however. That may very well be a red herring.