Hi, I am trying to mount an NFS share with Kerberos authentication. The mount without Kerberos works. However, as soon as I specify the krb5p flag in the exports file:
/srv/nfs4/data 192.168.0.0/24(rw,async,no_subtree_check,sec=krb5p)
the mount does not work anymore. The following error is shown:
+ sudo mount -v -t nfs -o sec=krb5 blaubaer:/srv/nfs4/data Test/
mount.nfs: timeout set for Thu Jan 28 14:40:09 2021
mount.nfs: trying text-based options 'sec=krb5,vers=4.2,addr=192.168.0.199,clientaddr=192.168.0.20'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,vers=4,minorversion=1,addr=192.168.0.199,clientaddr=192.168.0.20'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,vers=4,addr=192.168.0.199,clientaddr=192.168.0.20'
mount.nfs: mount(2): Invalid argument
mount.nfs: trying text-based options 'sec=krb5,addr=192.168.0.199'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: trying 192.168.0.199 prog 100003 vers 3 prot TCP port 2049
mount.nfs: prog 100005, trying vers=3, prot=17
mount.nfs: trying 192.168.0.199 prog 100005 vers 3 prot UDP port 20048
mount.nfs: mount(2): Invalid argument
mount.nfs: an incorrect mount option was specified
Do you have any idea what is going on? If I remove the -o sec=krb5 I get:
+ sudo mount -v -t nfs blaubaer:/srv/nfs4/data Test/
mount.nfs: timeout set for Thu Jan 28 14:40:48 2021
mount.nfs: trying text-based options 'vers=4.2,addr=192.168.0.199,clientaddr=192.168.0.20'
mount.nfs: mount(2): Operation not permitted
mount.nfs: trying text-based options 'addr=192.168.0.199'
mount.nfs: prog 100003, trying vers=3, prot=6
mount.nfs: trying 192.168.0.199 prog 100003 vers 3 prot TCP port 2049
mount.nfs: prog 100005, trying vers=3, prot=17
mount.nfs: trying 192.168.0.199 prog 100005 vers 3 prot UDP port 20048
mount.nfs: mount(2): Invalid argument
mount.nfs: Operation not permitted
In both cases, the server log reports:
Jan 28 14:38:48 blaubaer rpc.mountd[21643]: authenticated mount request from 192.168.0.20:874 for /srv/nfs4/data (/srv/nfs4/data)
I should probably say that the client has a valid kerberos ticket (tested with klist).