Subject: [nfsv4] Secure mount with Solaris Client with IP address.

From: Christopher T Vogan <[email-masked]>
Date: Tue, 8 Nov 2005 13:15:28 -0600

Has anyone tried to do a secure mount with the NFS servers IP Address from
a Solaris Client?

So far I have tried this from Linux and AIX with out a problem to a SUN NFS
server. But from a Sun Client to the SUN server I get    "nfs mount: mount:
/mnt: Permission denied   "  I did not expect this error, Mounting with the
hostnames to the same systems is successful. I am using SEAM as my KDC,

I have tried several combinations of this.  SUN to AIX, AIX to SUN, AIX to
Linux, SUN to Linux , SUN to AIX. Every time I use SUN as the Client The
mount fails, So it appears to me that it might be a SUN nfs client issue.
I don't believe I have a configuration  error. Mounts with hostnames are
successful. Unless I am missing something.

any thoughts?

Regards,

Christopher Vogan
Dept. W98 Integration, NFS

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Kevin Coffman <[email-masked]>
Date: Tue, 8 Nov 2005 14:24:17 -0500

With the MIT Kerberos code, it will do a reverse lookup of the IP
address to determine the service name to use.  A *guess* would be that
the SEAM code does not do this and is therefore trying to use the
service name 'nfs/<IP address>' rather than 'nfs/<hostname>'?

On 11/8/05, Christopher T Vogan <[email-masked]> wrote:
>
>
> Has anyone tried to do a secure mount with the NFS servers IP Address from a
> Solaris Client?
>
> mount fails, So it appears to me that it might be a SUN nfs client issue. I
> don't believe I have a configuration error. Mounts with hostnames are

---

From: Christopher T Vogan <[email-masked]>
Date: Tue, 8 Nov 2005 14:02:04 -0600

I thought about reverse look-ups,  I performed a network trace of the
mount, There was only 1 NFSv4 NULL CALL and Reply. The reply was
successful. But that was it. I dont think I am even getting that far as to
verifing creds yet.
But I can use a seam KDC with an AIX client to a SUN NFS server.

Christopher Vogan

             Kevin Coffman                                                 
             <[email-masked]                                             
             du>                                                        To 
             Sent by:                  Christopher T Vogan/San             
             [email-masked]         Jose/IBM@IBMUS                      
             om                                                         cc 
                                       [email-masked]                      
                                                                   Subject 
             11/08/2005 01:24          Re: [nfsv4] Secure mount with       
             PM                        Solaris Client with IP address.     

                                                                           

> mount fails, So it appears to me that it might be a SUN nfs client issue.
I

---

From: Kevin Coffman <[email-masked]>
Date: Tue, 8 Nov 2005 15:14:12 -0500

Well, the issue I was concerned about would be in the client's
Kerberos library code, so the KDC involved wouldn't matter.  But it
does sound like something else might be going on.

On 11/8/05, Christopher T Vogan <[email-masked]> wrote:
>
>
> I thought about reverse look-ups, I performed a network trace of the mount,
> There was only 1 NFSv4 NULL CALL and Reply. The reply was successful.
> But that was it. I dont think I am even getting that far as to verifing creds yet.
> To: Christopher T Vogan/San Jose/IBM@IBMUS
> cc: [email-masked]
> Subject:  Re: [nfsv4] Secure mount with Solaris Client with IP address.
>
>

---

From: "J. Bruce Fields" <[email-masked]>
Date: Tue, 8 Nov 2005 15:30:45 -0500

On Tue, Nov 08, 2005 at 02:02:04PM -0600, Christopher T Vogan wrote:
> successful. But that was it.

Well, that's what you'd expect, isn't it?  I thought the conjecture was
that the client was actually refusing to do the reverse lookup.

(And why are we doing them, anyway?  I can see the argument for their
being unsafe.)

--b.

---

From: Kevin Coffman <[email-masked]>
Date: Tue, 08 Nov 2005 20:11:57 -0500

> (And why are we doing them, anyway?  I can see the argument for their

The MIT Kerberos library does this for/to us for historical reasons.
I seem to recall seeing that Sun took this out of the SEAM code, but
I am not sure.

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 8 Nov 2005 20:29:12 -0600

> The MIT Kerberos library does this for/to us for historical reasons.

MIT krb5 now has an option to control this behaviour.

> I seem to recall seeing that Sun took this out of the SEAM code, but

No, Solaris still has this behaviour.

Nico
--

---

From: Christopher T Vogan <[email-masked]>
Date: Wed, 9 Nov 2005 09:44:04 -0600

The reason I brought up the issue on mounting NFSv4 shares by the IP
address with Kerberos Security is that it Works with NFSv3 with Kerberos
security. I was wondering why it did not work with NFSv4. If that is the
case then the problem probably is not with the SEAM code.

Christopher Vogan

             Nicolas Williams                                              
             <Nicolas.Williams                                             
             @sun.com>                                                  To 
                                       Kevin Coffman <[email-masked]>  
             11/08/2005 08:29                                           cc 
             PM                        "J. Bruce Fields"                   
                                       <[email-masked]>, Christopher 
                                       T Vogan/San Jose/IBM@IBMUS,         
                                       [email-masked]                      
                                                                   Subject 
                                       Re: [nfsv4] Secure mount with       
                                       Solaris Client with IP address.     

                                                                           

Nico