Slackware 14.2 NFS+Kerberos

My original aim was to make a serious effort at setting up NFS in a way that required passwords in order to access NFS exports, as I am considering whether to re-commission my file-server, and this time round Windows access would not a requirement. I soon concluded that the overheads of NFS+Kerberos were unjustifiably high for my likely requirements, but decided to press ahead with working stuff out. Even in a Linux-only environment Samba is so much easier to setup, and for my typical usage profile NFS has minimal performance advantage.

I did have more than a casual look at Heimdal, but in the end went for the reference MIT implementation of Kerberos. My earlier impression was that Heimdal was a better/cleaner implementation, but more of the documentation material I came across was aimed at the MIT Kerberos.

Baseline setup

krb.vm (192.168.56.21)

The Kerberos server.

nfs.vm (192.168.56.22)

The NFS server.

cli.vm (192.168.56.23)

The client machine.

Basic NFS

Server

chmod +x /etc/rc.d/rc.nfsd chmod +x /etc/rc.d/rc.rpc /etc/rc.d/rc.nfsd start /etc/rc.d/rc.rpc start mkdir /mnt/net1 mkdir /mnt/net2 chmod o+w /mnt/net1 chmod o+w /mnt/net2

Declare the export options:

/etc/exports

/mnt/net1 192.168.56.0/24(rw,root_squash,no_subtree_check) /mnt/net2 192.168.56.0/24(rw,root_squash,no_subtree_check)

# exportfs -arv exporting 192.168.56.0/24:/mnt/net2 exporting 192.168.56.0/24:/mnt/net1 # showmount -e localhost Export list for localhost: /mnt/net2 192.168.56.0/24 /mnt/net1 192.168.56.0/24

Client

# chmod +x /etc/rc.d/rc.rpc # /etc/rc.d/rc.rpc start Starting RPC portmapper: /sbin/rpcbind -l -w Starting RPC NSM (Network Status Monitor): /sbin/rpc.statd

Check the mounts are visible and working:

# showmount -e nfs.vm Export list for nfs.vm: /mnt/net2 192.168.56.0/24 /mnt/net1 192.168.56.0/24 # mount -t nfs -o vers=4 nfs.vm:/mnt/net1 /mnt/tmp/ $ echo test > /mnt/tmp/test.txt $ ls -l /mnt/tmp/ total 4 -rw-r--r-- 1 remy users 5 Jan 29 16:45 test.txt

Kerberos terminology

If the instance is absent, the slash after the primary is omitted. For users the primary is the username and the instance is usually not defined (it denotes a role if it is). For other cases such as hosts or services, the instance denotes the purpose (e.g. nfs), and the instance gives the server address (normally the FQDN). Canonically realms are meant to be domain names, but this is not strictly necessary.

Rebuilding NFS with Kerberos support

Since Slackware doesn't include any Kerberos libraries by default, Slackware's NFS libraries are built without gss support. Much of the effort in creating this guide was a combination of working out terminology, and guessing what a working NFS+Kerberos Ubuntu system had that a Slackware system didn't. Below details how to build the missing bits for Slackware.

krb5

libnfsidmap

wget https://fedorapeople.org/~steved/libnfsidmap/0.27/libnfsidmap-0.27.tar.gz tar -xzvf libnfsidmap-0.27.tar.gz cd libnfsidmap-0.27 ./configure --prefix=/usr make && make install

tirpc

MIRROR=https://www.mirrorservice.org/sites/ftp.slackware.com PKGPATH=/pub/slackware/slackware-14.2/source/n/libtirpc for file in doinst.sh.gz libtirpc-1.0.1.tar.xz libtirpc.SlackBuild slack-desc; do wget ${MIRROR}${PKGPATH}/$file done chmod +x libtirpc.SlackBuild WITH_GSS=yes ./libtirpc.SlackBuild removepkg libtirpc installpkg /tmp/libtirpc-1.0.1-i586-2.txz

nfs-utils

MIRROR=https://www.mirrorservice.org/sites/ftp.slackware.com PKGPATH=/pub/slackware/slackware-14.2/source/n/nfs-utils for file in doinst.sh.gz ignore_unsupported_address_types_in_nfssvc_setfds.diff.gz \ nfs-utils-1.3.3.tar.sign nfs-utils-1.3.3.tar.xz nfs-utils.SlackBuild \ nfs-utils.lwrap.needs.lnsl.diff.gz rc.nfsd slack-desc; do wget ${MIRROR}${PKGPATH}/$file done

The SlackBuild script nfs-utils.SlackBuild in this source package has gss disabled completely, and the only way to enable it is to modify said script. The following unified diff, which can be piped into patch -p0,will make these changes:

--- nfs-utils.SlackBuild-orig 2017-01-29 21:29:33.146154212 +0000 +++ nfs-utils.SlackBuild 2017-01-29 22:53:35.008929424 +0000 @@ -87,7 +87,8 @@ --with-statedir=/var/lib/nfs \ --enable-mountconfig \ - --enable-nfsv4=no \ + --enable-nfsv4=yes \ - --enable-gss=no \ + --enable-gss=yes \ + --enable-svcgss \ --enable-tirpc=yes \ --program-prefix= \ --program-suffix= \

Finally kick off the build and install the result:

chmod +x ./nfs-utils.SlackBuild ./nfs-utils.SlackBuild removepkg nfs-utils installpkg /tmp/nfs-utils-1.3.3-i586-2.txz

Kerberos server setup

/etc/krb5.conf

[libdefaults] default_realm = REMYNET dns_lookup_kdc = no dns_lookup_realm = no rdns = false [realms] REMYNET = { admin_server = krb.vm kdc = krb.vm } [logging] kdc = FILE:/var/log/kdc.log admin_server = FILE:/var/log/kadmin.log

/var/krb5kdc/kdc.conf

[kdcdefaults] kdc_ports = 750,88 [realms] REMYNET = { database_name = /var/krb5kdc/principal acl_file = /var/krb5kdc/kadm5.acl key_stash_file = /var/krb5kdc/.k5.REMYNET kdc_ports = 750,88 max_life = 1h 0m 0s max_renewable_life = 1d 0h 0m 0s }

/var/krb5kdc/kadm5.acl

master/admin *

Creating realm database

[root@S142 ~]# kdb5_util create -s Loading random data Initializing database '/var/krb5kdc/principal' for realm 'REMYNET', master key name 'K/M@REMYNET' You will be prompted for the database Master Password. It is important that you NOT FORGET this password. Enter KDC database master key: Re-enter KDC database master key to verify:

You don't need to use -r REMYNET as this will be picked up from the default_realm directive within krb5.conf.

Deleting realm database

/etc/krb5.conf

[libdefaults] default_realm = REMYNET rdns = false [realms] REMYNET = { admin_server = krb.vm kdc = krb.vm } [logging] default = STDERR

/etc/exports

/mnt/net1 192.168.56.0/24(rw,root_squash,no_subtree_check,sec=krb5) /mnt/net2 192.168.56.0/24(rw,root_squash,no_subtree_check)

/etc/fstab

/dev/sda2 swap swap defaults 0 0 /dev/sda1 / ext4 defaults 1 1 #/dev/cdrom /mnt/cdrom auto noauto,owner,ro,comment=x-gvfs-show 0 0 /dev/fd0 /mnt/floppy auto noauto,owner 0 0 devpts /dev/pts devpts gid=5,mode=620 0 0 proc /proc proc defaults 0 0 tmpfs /dev/shm tmpfs defaults 0 0 rpc_pipefs /var/lib/nfs/rpc_pipefs rpc_pipefs defaults 0 0

/etc/idmapd.conf

[General] Verbosity = 0 Pipefs-Directory = /var/lib/nfs/rpc_pipefs Domain = vm Local-Realms = REMYNET [Mapping] Nobody-User = nobody Nobody-Group = nogroup [Translation] Method = nsswitch,static [Static] remy@REMYNET = remy

Exporting keytab

Setting up rpc_pipefs mount-point

The rpc_pipefs mount-point is required by NFS4, and it has something to do with kernel communication for UID/GID mapping purposes. Either way, rpc.gssd wants it. The following line needs to be added to /etc/fstab:

rpc_pipefs /var/lib/nfs/rpc_pipefs rpc_pipefs defaults 0 0

..and then the mount-point needs to be created & used:

mkdir /var/lib/nfs/rpc_pipefs mount rpc_pipefs

Starting NFS w/Kerberos up

# echo N > /sys/module/nfs/parameters/nfs4_disable_idmapping # /etc/rc.d/rc.nfsd start Starting RPC portmapper: /sbin/rpcbind -l -w Starting RPC NSM (Network Status Monitor): /sbin/rpc.statd Starting NFS server daemons: /usr/sbin/exportfs -r /usr/sbin/rpc.rquotad /usr/sbin/rpc.nfsd 8 /usr/sbin/rpc.mountd # /etc/rc.d/rc.rpc start # rpc.gssd # rpc.svcgssd # rpc.idmapd

Most of the rpc daemons can be run in foreground mode with debug output using -f -vv parameters, which is usually quite good for diagnosing Kerberos issues such as missing keytab entries.

Mount something

The trust needed to access the NFS share is due to the machine itself being authorised by having the “password” for nfs/nfs.vm@REMYNET (and later on, nfs/cli.vm@REMYNET) present in the machine's keytab. For non-root users to get access, a further access token is required that lets the server work out what UID/GID should be served:

# su remy $ ls -l /mnt/tmp/ ls: cannot access 'mnt.tmp': Permission denied $ kinit remy Password for remy@REMYNET: $ ls -l /mnt/tmp/ total 5 -rw-r--r-- 1 nobody nogroup 5 Jan 31 17:52 root.txt

Setting up independent NFS client

# kadmin -p master/admin Authenticating as principal master/admin with password. Password for master/admin@REMYNET: kadmin: ktadd nfs/cli.vm@REMYNET Entry for principal nfs/cli.vm@REMYNET with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab. Entry for principal nfs/cli.vm@REMYNET with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.

Once this is done start the required daemons:

# echo N > /sys/module/nfs/parameters/nfs4_disable_idmapping # /etc/rc.d/rc.rpc start # rpc.gssd # rpc.idmapd

Now the client should be able to mount the shares.

UIDs &GIDs

add_principal, addprinc, ank

Add principal

delete_principal, delprinc

Delete principal

modify_principal, modprinc

Modify principal

rename_principal, renprinc

Rename principal

change_password, cpw

Change password

list_principals, listprincs, get_principals, getprincs

List principals

get_privs, getprivs

Get privileges

ktadd, xst

Add entry(s) to a keytab

ktremove, ktrem

Remove entry(s) from a keytab

lock

Lock database exclusively (use with extreme caution!)

unlock

Release exclusive database lock

purgekeys

Purge previously retained old keys from a principal

get_strings, getstrs

Show string attributes on a principal

set_string, setstr

Set a string attribute on a principal

del_string, delstr

Delete a string attribute on a principal

list_requests, lr, ?

List available requests.

quit, exit, q

Exit program.