SSSD & AD & Kerberized nfs

[Ondrej Valousek]

Hi all,

Just put together few findings about kerberized NFS & AD. See here:
https://ovalousek.wordpress.com/2015/10/15/enable-kerberized-nfs-with-sss...

Ondrej

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[John Beranek]

On 20 October 2015 at 12:33, Ondrej Valousek
<Ondrej.Valousek(a)s3group.com&gt; wrote:
>  Hi all,
>
>
>
>  Just put together few findings about kerberized NFS & AD. See here:
>
>
> https://ovalousek.wordpress.com/2015/10/15/enable-kerberized-nfs-with-sss...
Thanks for this, I've had another attempt to get an AD-sssd Linux
client (CentOS 6.7) to connect to our Isilon cluster kerberized, but
am not having much luck. When I try the mount I get:

mount.nfs: access denied by server while mounting .....

Upping idmapd verbosity to 9, I get the following: (here EXAMPLE.COM
is our long domain name, where a user would be joebloggs(a)EXAMPLE.COM
and AD.INT is the short domain name):

https://gist.github.com/jberanek/3c8a1a10704b6200dc1d

The only thing that doesn't quite fit from your guidance is that the
FQDN used to access the Isilon is actually a load-balanced A record,
where every time you lookup the name you get a different IP, with the
different reverse lookup...

e.g..

nfs.siteb.isilon.example.com -> 10.20.30.34 -> pool-00-04.siteb.example.com

Any ideas?

Cheers,

John

-- 
John Beranek                         To generalise is to be an idiot.
http://redux.org.uk/                                 -- William Blake

[Ondrej Valousek]

Read the document carefully and try again :)
IDmapper has a little to do with Kerberos. Care about the *gssd services - they handle
Kerberos.
RH-6.7 works nicely to me.

O.

-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of John Beranek
Sent: 20 October 2015 14:23
To: End-user discussions about the System Security Services Daemon
<sssd-users(a)lists.fedorahosted.org&gt;
Subject: Re: [SSSD-users] SSSD & AD & Kerberized nfs

On 20 October 2015 at 12:33, Ondrej Valousek <Ondrej.Valousek(a)s3group.com&gt; wrote:
>  Hi all,
>
>
>
>  Just put together few findings about kerberized NFS & AD. See here:
>
>  https://ovalousek.wordpress.com/2015/10/15/enable-kerberized-nfs-with-
>  sssd-and-active-directory/
>  
Thanks for this, I've had another attempt to get an AD-sssd Linux client (CentOS 6.7)
to connect to our Isilon cluster kerberized, but am not having much luck. When I try the
mount I get:

mount.nfs: access denied by server while mounting .....

Upping idmapd verbosity to 9, I get the following: (here EXAMPLE.COM is our long domain
name, where a user would be joebloggs(a)EXAMPLE.COM and AD.INT is the short domain name):

https://gist.github.com/jberanek/3c8a1a10704b6200dc1d

The only thing that doesn't quite fit from your guidance is that the FQDN used to
access the Isilon is actually a load-balanced A record, where every time you lookup the
name you get a different IP, with the different reverse lookup...

e.g..

nfs.siteb.isilon.example.com -> 10.20.30.34 -> pool-00-04.siteb.example.com

Any ideas?

Cheers,

John

-- 
John Beranek                         To generalise is to be an idiot.
http://redux.org.uk/                                 -- William Blake
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[John Beranek]

On 20 October 2015 at 14:28, Ondrej Valousek
<Ondrej.Valousek(a)s3group.com&gt; wrote:
>  Read the document carefully and try again :)
>  IDmapper has a little to do with Kerberos. Care about the *gssd services - they handle
> Kerberos.
>  RH-6.7 works nicely to me. 
Hmm, so it *is* the DNS for the Isilon service causing the issue:

https://gist.github.com/jberanek/f9475d4c0c756ee9e9e4

[Short version:
WARNING: Failed to create krb5 context for user with uid 0 for server
pool00-21.siteb.isilon.example.com
]

Can't really see how to solve that and leave the Isilon load balancing
in place. :(

John

-- 
John Beranek                         To generalise is to be an idiot.
http://redux.org.uk/                                 -- William Blake

[Ondrej Valousek]

Do you have the SPNs properly configured? As per the document.
Thing is that if you have more servers behind a single A record, RH-6 is not going to work
(details? see the document).
O.

-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of John Beranek
Sent: 20 October 2015 14:48
To: End-user discussions about the System Security Services Daemon
<sssd-users(a)lists.fedorahosted.org&gt;
Subject: Re: [SSSD-users] SSSD & AD & Kerberized nfs

On 20 October 2015 at 14:28, Ondrej Valousek <Ondrej.Valousek(a)s3group.com&gt; wrote:
>  Read the document carefully and try again :) IDmapper has a little to
>
>  do with Kerberos. Care about the *gssd services - they handle Kerberos.
>  RH-6.7 works nicely to me.
>  
Hmm, so it *is* the DNS for the Isilon service causing the issue:

https://gist.github.com/jberanek/f9475d4c0c756ee9e9e4

[Short version:
WARNING: Failed to create krb5 context for user with uid 0 for server
pool00-21.siteb.isilon.example.com
]

Can't really see how to solve that and leave the Isilon load balancing in place. :(

John

-- 
John Beranek                         To generalise is to be an idiot.
http://redux.org.uk/                                 -- William Blake
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[John Beranek]

On 20 October 2015 at 14:53, Ondrej Valousek
<Ondrej.Valousek(a)s3group.com&gt; wrote:
>  Do you have the SPNs properly configured? As per the document.
>  Thing is that if you have more servers behind a single A record, RH-6 is not going to
> work (details? see the document). 
Yes, that's the issue. The Isilon storage system in question has 32
IPs and therefore 32 A records and 32 PTR records. I don't really want
to put 32 more items in the SPN...

John

-- 
John Beranek                         To generalise is to be an idiot.
http://redux.org.uk/                                 -- William Blake

[Ondrej Valousek]

Then you have 3 options, really:
- Reconfigure DNS PTRs for all servers to resolve to the same name (not sure if it is
gonna work, though)
- Use RH-7 & FQDN
- get rid of that nasty DNS based load balancing hack and use something like pNFS.

O.


-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of John Beranek
Sent: 20 October 2015 15:05
To: End-user discussions about the System Security Services Daemon
<sssd-users(a)lists.fedorahosted.org&gt;
Subject: Re: [SSSD-users] SSSD & AD & Kerberized nfs

On 20 October 2015 at 14:53, Ondrej Valousek <Ondrej.Valousek(a)s3group.com&gt; wrote:
>  Do you have the SPNs properly configured? As per the document.
>  Thing is that if you have more servers behind a single A record, RH-6 is not going to
> work (details? see the document).
>  
Yes, that's the issue. The Isilon storage system in question has 32 IPs and therefore
32 A records and 32 PTR records. I don't really want to put 32 more items in the
SPN...

John

-- 
John Beranek                         To generalise is to be an idiot.
http://redux.org.uk/                                 -- William Blake
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[John Hodrien]

On Tue, 20 Oct 2015, John Beranek wrote:

>  Can't really see how to solve that and leave the Isilon load
> balancing
>  in place. :( 
Can you explain simply how your load balacing is working?

jh

[John Beranek]

On 20 October 2015 at 15:04, John Hodrien <J.H.Hodrien(a)leeds.ac.uk&gt; wrote:
>  On Tue, 20 Oct 2015, John Beranek wrote:
>
> > Can't really see how to solve that and leave the Isilon load balancing
> > in place. :(
>
>
>  Can you explain simply how your load balacing is working? 
OK, so the Isilon cluster itself provides the DNS zone:

nfs.siteb.isilon.example.com

When a client looks up this name in DNS, the Isilon gives out one of
the IPs in the pool, pointing to an IP address which is hosted by one
of the Isilon nodes. It can do this by a number of criteria:

* Round robin
* Connection count
* Network throughput
* CPU usage

John

-- 
John Beranek                         To generalise is to be an idiot.
http://redux.org.uk/                                 -- William Blake

[John Hodrien]

On Tue, 20 Oct 2015, Ondrej Valousek wrote:

>  Hi all,
>
>  Just put together few findings about kerberized NFS & AD. See here:
>
> https://ovalousek.wordpress.com/2015/10/15/enable-kerberized-nfs-with-sss...
For people hosting NFS/krb5 on EL6, there certainly used to be problems if you
had PAC enabled on the server for users who were members of many groups.

The solution is to disable PAC for services on that host via
userAccountControl.

userAccountControl: 33624064

That then causes fun, as Samba on EL6 can't cope with PAC being disabled.  Cue
fun with running two AD objects per server, and merging of keytabs such that
you can have PAC on Samba and not on NFS.

userAccountControl: 69632

jh

[Ondrej Valousek]

Will add this to my document, thanks.
I have heard about this issue - but how many is "many groups"?
I have user here with 32 groups - I do not experience any problems.
O.

-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of John Hodrien
Sent: 20 October 2015 15:07
To: End-user discussions about the System Security Services Daemon
<sssd-users(a)lists.fedorahosted.org&gt;
Subject: Re: [SSSD-users] SSSD & AD & Kerberized nfs

On Tue, 20 Oct 2015, Ondrej Valousek wrote:

>  Hi all,
>
>  Just put together few findings about kerberized NFS & AD. See here:
>  https://ovalousek.wordpress.com/2015/10/15/enable-kerberized-nfs-with-
>  sssd-and-active-directory/
>  
For people hosting NFS/krb5 on EL6, there certainly used to be problems if you had PAC
enabled on the server for users who were members of many groups.

The solution is to disable PAC for services on that host via userAccountControl.

userAccountControl: 33624064

That then causes fun, as Samba on EL6 can't cope with PAC being disabled.  Cue fun
with running two AD objects per server, and merging of keytabs such that you can have PAC
on Samba and not on NFS.

userAccountControl: 69632

jh
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[John Hodrien]

On Tue, 20 Oct 2015, Ondrej Valousek wrote:

>  Will add this to my document, thanks.
>  I have heard about this issue - but how many is "many groups"?
>  I have user here with 32 groups - I do not experience any problems. 
I'm not sure.  150 is definitely too many groups.  Yes, it's definitely too
many groups even without NFS.  It's related to whether the PAC fits in a page
AFAIK.

The other part of the fix with AD, one you have these two computer objects:

myhost
myhost-nfs

ktpass -princ nfs/myhost.domain@REALM -mapuser myhost-nfs$ +rndPass -out temp.keytab
-crypto ALL

That then gives you a keytab to merge into the first, so on the client it
looks like a perfectly normal setup.

I don't know whether you can do this all from the linux side.

jh

[Ondrej Valousek]

Ok, thanks - page updated.
AFAIK, this is NFS server problem - fortunately, we are using Netapp, so I do not worry
:)

Sorry SSSD team for abusing this list...

-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of John Hodrien
Sent: 20 October 2015 15:29
To: End-user discussions about the System Security Services Daemon
<sssd-users(a)lists.fedorahosted.org&gt;
Subject: Re: [SSSD-users] SSSD & AD & Kerberized nfs

On Tue, 20 Oct 2015, Ondrej Valousek wrote:

>  Will add this to my document, thanks.
>  I have heard about this issue - but how many is "many groups"?
>  I have user here with 32 groups - I do not experience any problems.
>  
I'm not sure.  150 is definitely too many groups.  Yes, it's definitely too many
groups even without NFS.  It's related to whether the PAC fits in a page AFAIK.

The other part of the fix with AD, one you have these two computer objects:

myhost
myhost-nfs

ktpass -princ nfs/myhost.domain@REALM -mapuser myhost-nfs$ +rndPass -out temp.keytab
-crypto ALL

That then gives you a keytab to merge into the first, so on the client it looks like a
perfectly normal setup.

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[Longina Przybyszewska]

Hi,
For me configuring idmapd in cross realm with SSSD and NFSv4 is challenging;
Idmapd.conf manual says: An NFSv4  domain  is  a  namespace with   a  unique
uid<->username, gid<->usergroupname;
Domain defaults to machine's domainname.

Using Method = nsswitch, I  expect that idmapd request  to sssd-nss would be used for
mapping.

If sssd can resolve login names as short names, unique in cross realm , feks. 
sAMAccountName names - mapping works;
In that case , Domain  can be anything - it is stripped off;

If login names are resolved as fqdn in cross realm, mapping doesn’t work if computer's
domain differs from user's domain.
Kerberized nfs homedir is mounted but  mapping to nobody/nogroup blocks user from login.

In my case NFS client machines and NFSv4 server  are in the same domain;
Users are from different domains.
Longina

>  -----Oprindelig meddelelse-----
>  Fra: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-
>  bounces(a)lists.fedorahosted.org] På vegne af Ondrej Valousek
>  Sendt: 20. oktober 2015 16:14
>  Til: End-user discussions about the System Security Services Daemon
>  Emne: Re: [SSSD-users] SSSD & AD & Kerberized nfs
>  
>  Will add this to my document, thanks.
>  I have heard about this issue - but how many is "many groups"?
>  I have user here with 32 groups - I do not experience any problems.
>  O.
>  
>  -----Original Message-----
>  From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-
>  bounces(a)lists.fedorahosted.org] On Behalf Of John Hodrien
>  Sent: 20 October 2015 15:07
>  To: End-user discussions about the System Security Services Daemon <sssd-
>  users(a)lists.fedorahosted.org&gt;
>  Subject: Re: [SSSD-users] SSSD & AD & Kerberized nfs
>  
>  On Tue, 20 Oct 2015, Ondrej Valousek wrote:
>  
>  > Hi all,
>  >
>  > Just put together few findings about kerberized NFS & AD. See here:
>  > https://ovalousek.wordpress.com/2015/10/15/enable-kerberized-nfs-
>  with-
>  > sssd-and-active-directory/
>  
>  For people hosting NFS/krb5 on EL6, there certainly used to be problems if
>  you had PAC enabled on the server for users who were members of many
>  groups.
>  
>  The solution is to disable PAC for services on that host via
>  userAccountControl.
>  
>  userAccountControl: 33624064
>  
>  That then causes fun, as Samba on EL6 can't cope with PAC being disabled.
>  Cue fun with running two AD objects per server, and merging of keytabs
>  such that you can have PAC on Samba and not on NFS.
>  
>  userAccountControl: 69632
>  
>  jh
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>  
>  -----
>  
>  The information contained in this e-mail and in any attachments is
>  confidential and is designated solely for the attention of the intended
>  recipient(s). If you are not an intended recipient, you must not use, disclose,
>  copy, distribute or retain this e-mail or any part thereof. If you have received
>  this e-mail in error, please notify the sender by return e-mail and delete all
>  copies of this e-mail from your computer system(s). Please direct any
>  additional queries to: communications(a)s3group.com. Thank You. Silicon and
>  Software Systems Limited (S3 Group). Registered in Ireland no. 378073.
>  Registered Office: South County Business Park, Leopardstown, Dublin 18.
>  _______________________________________________
>  sssd-users mailing list
>  sssd-users(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>