Kerberos的nfs在挂载时验证出错

waldo

在实验的过程中，普通模式的nfs是能正常挂载的（附件1、2）但是开启Kerberos后挂载出现验证失败（附件3、4、5，附件5是日志）
时间一直是同步状态，并且keytab已经尝试重建

botang

试验ldap用户时，应该使用ssh，避免使用su -


下面的黄色部分也不是错，说明root没有kerberos的原则


下面这些，我知道你已经改成sec=krb5p

waldo

唐老师，classroom上已按要求重启过，并且也尝试使用ssh连接，还是不行
classroom上的操作记录：

1. [root@classroom ~]# systemctl restart nfs-server
   
2. [root@classroom ~]# systemctl restart nfs-mountd
   
3. [root@classroom ~]# systemctl restart nfs-idmapd
   
4. [root@classroom ~]# systemctl restart rpcbind   
   
5. [root@classroom ~]# systemctl status nfs-server
   
6. ● nfs-server.service - NFS server and services
   
7.    Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; enabled; vendor preset: disabled)
   
8.   Drop-In: /run/systemd/generator/nfs-server.service.d
   
9.            └─order-with-mounts.conf
   
10.    Active: active (exited) since Sun 2020-02-23 11:45:38 CST; 14s ago
    
11.   Process: 14446 ExecStopPost=/usr/sbin/exportfs -f (code=exited, status=0/SUCCESS)
    
12.   Process: 14444 ExecStopPost=/usr/sbin/exportfs -au (code=exited, status=0/SUCCESS)
    
13.   Process: 14442 ExecStop=/usr/sbin/rpc.nfsd 0 (code=exited, status=0/SUCCESS)
    
14.   Process: 14469 ExecStart=/bin/sh -c if systemctl -q is-active gssproxy; then systemctl reload gssproxy ; fi (code=exited, status=0/SUCCESS)
    
15.   Process: 14456 ExecStart=/usr/sbin/rpc.nfsd (code=exited, status=0/SUCCESS)
    
16.   Process: 14454 ExecStartPre=/usr/sbin/exportfs -r (code=exited, status=0/SUCCESS)
    
17. Main PID: 14469 (code=exited, status=0/SUCCESS)
    
18.     Tasks: 0 (limit: 11366)
    
19.    Memory: 0B
    
20.    CGroup: /system.slice/nfs-server.service
    
21. 
    
22. Feb 23 11:45:38 classroom.example.com systemd[1]: Starting NFS server and services...
    
23. Feb 23 11:45:38 classroom.example.com systemd[1]: Started NFS server and services.
    
24. [root@classroom ~]# systemctl status nfs-mountd
    
25. ● nfs-mountd.service - NFS Mount Daemon
    
26.    Loaded: loaded (/usr/lib/systemd/system/nfs-mountd.service; static; vendor preset: disabled)
    
27.    Active: active (running) since Sun 2020-02-23 11:45:38 CST; 23s ago
    
28.   Process: 14451 ExecStart=/usr/sbin/rpc.mountd (code=exited, status=0/SUCCESS)
    
29. Main PID: 14453 (rpc.mountd)
    
30.     Tasks: 1 (limit: 11366)
    
31.    Memory: 1.3M
    
32.    CGroup: /system.slice/nfs-mountd.service
    
33.            └─14453 /usr/sbin/rpc.mountd
    
34. 
    
35. Feb 23 11:45:38 classroom.example.com systemd[1]: Stopped NFS Mount Daemon.
    
36. Feb 23 11:45:38 classroom.example.com systemd[1]: Starting NFS Mount Daemon...
    
37. Feb 23 11:45:38 classroom.example.com systemd[1]: Started NFS Mount Daemon.
    
38. Feb 23 11:45:38 classroom.example.com rpc.mountd[14453]: Version 2.3.3 starting
    
39. [root@classroom ~]# systemctl status nfs-idmapd
    
40. ● nfs-idmapd.service - NFSv4 ID-name mapping service
    
41.    Loaded: loaded (/usr/lib/systemd/system/nfs-idmapd.service; static; vendor preset: disabled)
    
42.    Active: active (running) since Sun 2020-02-23 11:45:42 CST; 25s ago
    
43.   Process: 14477 ExecStart=/usr/sbin/rpc.idmapd (code=exited, status=0/SUCCESS)
    
44. Main PID: 14478 (rpc.idmapd)
    
45.     Tasks: 1 (limit: 11366)
    
46.    Memory: 1.0M
    
47.    CGroup: /system.slice/nfs-idmapd.service
    
48.            └─14478 /usr/sbin/rpc.idmapd
    
49. 
    
50. Feb 23 11:45:42 classroom.example.com systemd[1]: Starting NFSv4 ID-name mapping service...
    
51. Feb 23 11:45:42 classroom.example.com rpc.idmapd[14478]: Setting log level to 0
    
52. Feb 23 11:45:42 classroom.example.com systemd[1]: Started NFSv4 ID-name mapping service.
    
53. [root@classroom ~]# systemctl status rpc-bind
    
54. Unit rpc-bind.service could not be found.
    
55. [root@classroom ~]# systemctl status rpcbind
    
56. ● rpcbind.service - RPC Bind
    
57.    Loaded: loaded (/usr/lib/systemd/system/rpcbind.service; enabled; vendor preset: enabled)
    
58.    Active: active (running) since Sun 2020-02-23 11:45:45 CST; 38s ago
    
59.      Docs: man:rpcbind(8)
    
60. Main PID: 14482 (rpcbind)
    
61.     Tasks: 1 (limit: 11366)
    
62.    Memory: 924.0K
    
63.    CGroup: /system.slice/rpcbind.service
    
64.            └─14482 /usr/bin/rpcbind -w -f
    
65. 
    
66. Feb 23 11:45:45 classroom.example.com systemd[1]: Stopped RPC Bind.
    
67. Feb 23 11:45:45 classroom.example.com systemd[1]: Starting RPC Bind...
    
68. Feb 23 11:45:45 classroom.example.com systemd[1]: Started RPC Bind.
    
69. [root@classroom ~]# cat /etc/exports
    
70. /var/ftp/pub    192.168.0.0/255.255.255.0(ro,sync,no_root_squash) 192.168.1.0/255.255.255.0(ro,sync,no_root_squash)
    
71. /home/guests    192.168.0.0/255.255.255.0(rw,sync,sec=krb5p)
    
72. [root@classroom ~]#

复制代码

desktop上的操作记录：

1. [root@desktop2 ~]# systemctl restart nfs-client.target
   
2. [root@desktop2 ~]# systemctl restart nfs-idmapd      
   
3. [root@desktop2 ~]# systemctl restart autofs           
   
4. [root@desktop2 ~]# ssh ldapuser2@desktop2.example.com
   
5. Password:
   
6. Activate the web console with: systemctl enable --now cockpit.socket
   
7. 
   
8. Last failed login: Sun Feb 23 11:53:43 CST 2020 from 192.168.0.2 on ssh:notty
   
9. There was 1 failed login attempt since the last successful login.
   
10. Last login: Sun Feb 23 11:52:39 2020 from 192.168.0.2
    
11. Could not chdir to home directory /home/guests/ldapuser2: No such file or directory
    
12. [ldapuser2@desktop2 /]$ exit
    
13. logout
    
14. Connection to desktop2.example.com closed.
    
15. [root@desktop2 ~]# systemctl status nfs-client.target
    
16. ● nfs-client.target - NFS client services
    
17.    Loaded: loaded (/usr/lib/systemd/system/nfs-client.target; enabled; vendor preset: disabled)
    
18.    Active: active since Sun 2020-02-23 11:53:12 CST; 1min 1s ago
    
19. 
    
20. Feb 23 11:53:12 desktop2.example.com systemd[1]: Stopped target NFS client services.
    
21. Feb 23 11:53:12 desktop2.example.com systemd[1]: Stopping NFS client services.
    
22. Feb 23 11:53:12 desktop2.example.com systemd[1]: Reached target NFS client services.
    
23. [root@desktop2 ~]# systemctl status nfs-idmapd
    
24. ● nfs-idmapd.service - NFSv4 ID-name mapping service
    
25.    Loaded: loaded (/usr/lib/systemd/system/nfs-idmapd.service; static; vendor preset: disabled)
    
26.    Active: active (running) since Sun 2020-02-23 11:53:17 CST; 1min 4s ago
    
27.   Process: 14977 ExecStart=/usr/sbin/rpc.idmapd (code=exited, status=0/SUCCESS)
    
28. Main PID: 14978 (rpc.idmapd)
    
29.     Tasks: 1 (limit: 49667)
    
30.    Memory: 1.0M
    
31.    CGroup: /system.slice/nfs-idmapd.service
    
32.            └─14978 /usr/sbin/rpc.idmapd
    
33. 
    
34. Feb 23 11:53:17 desktop2.example.com systemd[1]: Starting NFSv4 ID-name mapping service...
    
35. Feb 23 11:53:17 desktop2.example.com rpc.idmapd[14978]: Setting log level to 0
    
36. Feb 23 11:53:17 desktop2.example.com systemd[1]: Started NFSv4 ID-name mapping service.
    
37. [root@desktop2 ~]# systemctl status autofs
    
38. ● autofs.service - Automounts filesystems on demand
    
39.    Loaded: loaded (/usr/lib/systemd/system/autofs.service; enabled; vendor preset: disabled)
    
40.    Active: active (running) since Sun 2020-02-23 11:53:25 CST; 1min 3s ago
    
41. Main PID: 14994 (automount)
    
42.     Tasks: 6 (limit: 49667)
    
43.    Memory: 7.6M
    
44.    CGroup: /system.slice/autofs.service
    
45.            └─14994 /usr/sbin/automount --foreground --dont-check-daemon
    
46. 
    
47. Feb 23 11:53:25 desktop2.example.com systemd[1]: Starting Automounts filesystems on demand...
    
48. Feb 23 11:53:25 desktop2.example.com automount[14994]: setautomntent: lookup(sss): setautomntent: No such file or directory
    
49. Feb 23 11:53:25 desktop2.example.com automount[14994]: setautomntent: lookup(sss): setautomntent: No such file or directory
    
50. Feb 23 11:53:25 desktop2.example.com automount[14994]: setautomntent: lookup(sss): setautomntent: No such file or directory
    
51. Feb 23 11:53:25 desktop2.example.com systemd[1]: Started Automounts filesystems on demand.
    
52. [root@desktop2 ~]# head -n 10 /etc/auto.guests
    
53. #
    
54. # This is an automounter map and it has the following format
    
55. # key [ -mount-options-separated-by-comma ] location
    
56. # Details may be found in the autofs(5) manpage
    
57. 
    
58. #cd             -fstype=iso9660,ro,nosuid,nodev :/dev/cdrom
    
59. 
    
60. # the following entries are samples to pique your imagination
    
61. *               -rw,soft,intr,sec=krb5p         classroom.example.com:/home/guests/&
    
62. #linux          -ro,soft,intr           ftp.example.org:/pub/linux
    
63. [root@desktop2 ~]#

复制代码

desktop的日志：

1. Last login: Sun Feb 23 00:31:15 2020 from 192.168.0.1
   
2. [root@desktop2 ~]# rpc.gssd -v -v -v -v -v -f
   
3. doing a full rescan
   
4. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntf3) ev->mask (0x40000100)
   
5. inotify event for clntdir (nfs/clntf3) - ev->wd (11) ev->name (idmap) ev->mask (0x00000100)
   
6. handle_gssd_upcall: 'mech=krb5 uid=0 service=* enctypes=18,17,16,23,3,1,2 ' (nfs/clntf3)
   
7. krb5_use_machine_creds: uid 0 tgtname (null)
   
8. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=* srchost=(null)
   
9. Full hostname for 'classroom.example.com' is 'classroom.example.com'
   
10. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
    
11. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
    
12. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
    
13. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
    
14. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
    
15. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
    
16. gssd_get_single_krb5_cred: principal 'host/desktop2.example.com@EXAMPLE.COM' ccache:'FILE:/tmp/krb5ccmachine_EXAMPLE.COM'
    
17. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
    
18. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
    
19. creating tcp client for server classroom.example.com
    
20. DEBUG: port already set to 2049
    
21. creating context with server nfs@classroom.example.com
    
22. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
    
23. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
    
24. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
    
25. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=* srchost=(null)
    
26. Full hostname for 'classroom.example.com' is 'classroom.example.com'
    
27. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
    
28. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
    
29. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
    
30. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
    
31. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
    
32. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
    
33. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
    
34. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
    
35. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
    
36. creating tcp client for server classroom.example.com
    
37. DEBUG: port already set to 2049
    
38. creating context with server nfs@classroom.example.com
    
39. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
    
40. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
    
41. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
    
42. doing error downcall
    
43. handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clntf3)
    
44. krb5_use_machine_creds: uid 0 tgtname (null)
    
45. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
    
46. Full hostname for 'classroom.example.com' is 'classroom.example.com'
    
47. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
    
48. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
    
49. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
    
50. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
    
51. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
    
52. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
    
53. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
    
54. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
    
55. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
    
56. creating tcp client for server classroom.example.com
    
57. DEBUG: port already set to 2049
    
58. creating context with server nfs@classroom.example.com
    
59. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
    
60. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
    
61. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
    
62. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
    
63. Full hostname for 'classroom.example.com' is 'classroom.example.com'
    
64. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
    
65. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
    
66. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
    
67. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
    
68. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
    
69. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
    
70. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
    
71. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
    
72. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
    
73. creating tcp client for server classroom.example.com
    
74. DEBUG: port already set to 2049
    
75. creating context with server nfs@classroom.example.com
    
76. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
    
77. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
    
78. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
    
79. doing error downcall
    
80. handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clntf3)
    
81. krb5_use_machine_creds: uid 0 tgtname (null)
    
82. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
    
83. Full hostname for 'classroom.example.com' is 'classroom.example.com'
    
84. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
    
85. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
    
86. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
    
87. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
    
88. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
    
89. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
    
90. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
    
91. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
    
92. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
    
93. creating tcp client for server classroom.example.com
    
94. DEBUG: port already set to 2049
    
95. creating context with server nfs@classroom.example.com
    
96. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
    
97. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
    
98. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
    
99. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
    
100. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
101. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
102. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
103. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
104. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
105. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
106. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
107. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
108. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
     
109. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
110. creating tcp client for server classroom.example.com
     
111. DEBUG: port already set to 2049
     
112. creating context with server nfs@classroom.example.com
     
113. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
114. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
115. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
     
116. doing error downcall
     
117. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntf4) ev->mask (0x40000100)
     
118. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntf5) ev->mask (0x40000100)
     
119. handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clntf3)
     
120. krb5_use_machine_creds: uid 0 tgtname (null)
     
121. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
122. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
123. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
124. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
125. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
126. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
127. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
128. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
129. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
130. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
     
131. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
132. creating tcp client for server classroom.example.com
     
133. DEBUG: port already set to 2049
     
134. creating context with server nfs@classroom.example.com
     
135. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
136. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
137. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
     
138. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
139. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
140. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
141. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
142. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
143. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
144. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
145. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
146. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
147. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
     
148. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
149. creating tcp client for server classroom.example.com
     
150. DEBUG: port already set to 2049
     
151. creating context with server nfs@classroom.example.com
     
152. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
153. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
154. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
     
155. doing error downcall
     
156. inotify event for clntdir (nfs/clntf5) - ev->wd (13) ev->name (info) ev->mask (0x00000200)
     
157. inotify event for clntdir (nfs/clntf5) - ev->wd (13) ev->name (<?>) ev->mask (0x00008000)
     
158. inotify event for clntdir (nfs/clntf3) - ev->wd (11) ev->name (idmap) ev->mask (0x00000200)
     
159. inotify event for clntdir (nfs/clntf4) - ev->wd (12) ev->name (info) ev->mask (0x00000200)
     
160. inotify event for clntdir (nfs/clntf3) - ev->wd (11) ev->name (krb5) ev->mask (0x00000200)
     
161. inotify event for clntdir (nfs/clntf3) - ev->wd (11) ev->name (gssd) ev->mask (0x00000200)
     
162. inotify event for clntdir (nfs/clntf3) - ev->wd (11) ev->name (info) ev->mask (0x00000200)
     
163. inotify event for clntdir (nfs/clntf3) - ev->wd (11) ev->name (<?>) ev->mask (0x00008000)
     
164. inotify event for clntdir (nfs/clntf4) - ev->wd (12) ev->name (<?>) ev->mask (0x00008000)
     
165. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntf6) ev->mask (0x40000100)
     
166. inotify event for clntdir (nfs/clntf6) - ev->wd (14) ev->name (idmap) ev->mask (0x00000100)
     
167. handle_gssd_upcall: 'mech=krb5 uid=0 service=* enctypes=18,17,16,23,3,1,2 ' (nfs/clntf6)
     
168. krb5_use_machine_creds: uid 0 tgtname (null)
     
169. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=* srchost=(null)
     
170. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
171. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
172. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
173. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
174. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
175. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
176. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
177. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
178. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
     
179. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
180. creating tcp client for server classroom.example.com
     
181. DEBUG: port already set to 2049
     
182. creating context with server nfs@classroom.example.com
     
183. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
184. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
185. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
     
186. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=* srchost=(null)
     
187. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
188. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
189. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
190. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
191. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
192. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
193. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
194. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
195. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
     
196. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
197. creating tcp client for server classroom.example.com
     
198. DEBUG: port already set to 2049
     
199. creating context with server nfs@classroom.example.com
     
200. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
201. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
202. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
     
203. doing error downcall
     
204. handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clntf6)
     
205. krb5_use_machine_creds: uid 0 tgtname (null)
     
206. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
207. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
208. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
209. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
210. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
211. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
212. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
213. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
214. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
215. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
     
216. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
217. creating tcp client for server classroom.example.com
     
218. DEBUG: port already set to 2049
     
219. creating context with server nfs@classroom.example.com
     
220. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
221. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
222. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
     
223. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
224. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
225. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
226. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
227. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
228. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
229. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
230. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
231. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
232. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
     
233. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
234. creating tcp client for server classroom.example.com
     
235. DEBUG: port already set to 2049
     
236. creating context with server nfs@classroom.example.com
     
237. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
238. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
239. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
     
240. doing error downcall
     
241. handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clntf6)
     
242. krb5_use_machine_creds: uid 0 tgtname (null)
     
243. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
244. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
245. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
246. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
247. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
248. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
249. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
250. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
251. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
252. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
     
253. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
254. creating tcp client for server classroom.example.com
     
255. DEBUG: port already set to 2049
     
256. creating context with server nfs@classroom.example.com
     
257. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
258. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
259. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
     
260. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
261. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
262. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
263. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
264. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
265. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
266. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
267. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
268. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
269. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fe574001e60 service=(null) srchost=(null)
     
270. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582516426
     
271. creating tcp client for server classroom.example.com
     
272. DEBUG: port already set to 2049
     
273. creating context with server nfs@classroom.example.com
     
274. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
275. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
276. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
     
277. doing error downcall
     
278. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntf7) ev->mask (0x40000100)
     
279. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntf8) ev->mask (0x40000100)
     
280. WARNING: gssd_clnt_gssd_cb: failed reading request
     
281. inotify event for clntdir (nfs/clntf8) - ev->wd (16) ev->name (info) ev->mask (0x00000200)
     
282. inotify event for clntdir (nfs/clntf8) - ev->wd (16) ev->name (<?>) ev->mask (0x00008000)
     
283. inotify event for clntdir (nfs/clntf6) - ev->wd (14) ev->name (idmap) ev->mask (0x00000200)
     
284. inotify event for clntdir (nfs/clntf7) - ev->wd (15) ev->name (info) ev->mask (0x00000200)
     
285. inotify event for clntdir (nfs/clntf6) - ev->wd (14) ev->name (krb5) ev->mask (0x00000200)
     
286. inotify event for clntdir (nfs/clntf6) - ev->wd (14) ev->name (gssd) ev->mask (0x00000200)
     
287. inotify event for clntdir (nfs/clntf6) - ev->wd (14) ev->name (info) ev->mask (0x00000200)
     
288. inotify event for clntdir (nfs/clntf6) - ev->wd (14) ev->name (<?>) ev->mask (0x00008000)
     
289. inotify event for clntdir (nfs/clntf7) - ev->wd (15) ev->name (<?>) ev->mask (0x00008000)
     
290. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntf9) ev->mask (0x40000100)
     
291. inotify event for clntdir (nfs/clntf9) - ev->wd (17) ev->name (idmap) ev->mask (0x00000100)
     
292. WARNING: gssd_clnt_gssd_cb: failed reading request
     
293. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntfa) ev->mask (0x40000100)
     
294. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntfb) ev->mask (0x40000100)
     
295. WARNING: gssd_clnt_gssd_cb: failed reading request
     
296. inotify event for clntdir (nfs/clntfb) - ev->wd (19) ev->name (info) ev->mask (0x00000200)
     
297. inotify event for clntdir (nfs/clntfb) - ev->wd (19) ev->name (<?>) ev->mask (0x00008000)
     
298. inotify event for clntdir (nfs/clntf9) - ev->wd (17) ev->name (idmap) ev->mask (0x00000200)
     
299. inotify event for clntdir (nfs/clntfa) - ev->wd (18) ev->name (info) ev->mask (0x00000200)
     
300. inotify event for clntdir (nfs/clntf9) - ev->wd (17) ev->name (krb5) ev->mask (0x00000200)
     
301. inotify event for clntdir (nfs/clntf9) - ev->wd (17) ev->name (gssd) ev->mask (0x00000200)
     
302. inotify event for clntdir (nfs/clntf9) - ev->wd (17) ev->name (info) ev->mask (0x00000200)
     
303. inotify event for clntdir (nfs/clntf9) - ev->wd (17) ev->name (<?>) ev->mask (0x00008000)
     
304. inotify event for clntdir (nfs/clntfa) - ev->wd (18) ev->name (<?>) ev->mask (0x00008000)
     
305. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntfc) ev->mask (0x40000100)
     
306. inotify event for topdir (nfs) - ev->wd (8) ev->name (clntfd) ev->mask (0x40000100)
     
307. inotify event for clntdir (nfs/clntfc) - ev->wd (20) ev->name (gssd) ev->mask (0x00000100)
     
308. inotify event for clntdir (nfs/clntfc) - ev->wd (20) ev->name (krb5) ev->mask (0x00000100)
     
309. inotify event for clntdir (nfs/clntfc) - ev->wd (20) ev->name (krb5) ev->mask (0x00000200)
     
310. inotify event for clntdir (nfs/clntfc) - ev->wd (20) ev->name (gssd) ev->mask (0x00000200)
     
311. inotify event for clntdir (nfs/clntfd) - ev->wd (21) ev->name (info) ev->mask (0x00000200)
     
312. inotify event for clntdir (nfs/clntfc) - ev->wd (20) ev->name (info) ev->mask (0x00000200)
     
313. inotify event for clntdir (nfs/clntfc) - ev->wd (20) ev->name (<?>) ev->mask (0x00008000)
     
314. inotify event for clntdir (nfs/clntfd) - ev->wd (21) ev->name (<?>) ev->mask (0x00008000)
     

复制代码

botang

waldo 发表于 2020-2-23 11:58
唐老师，classroom上已按要求重启过，并且也尝试使用ssh连接，还是不行
classroom上的操作记录：

1. [root@desktop4 etc]# ipa-rmkeytab  -p host/desktop4.example.com    -k /etc/krb5.keytab
   

复制代码

botang

waldo 发表于 2020-2-23 11:58
唐老师，classroom上已按要求重启过，并且也尝试使用ssh连接，还是不行
classroom上的操作记录：

如果重新生成classroom.example.com的krb5.keytab，那么由于其中有随机数，所以：
问题出在nfs客户端这边，尝试一下下面的命令，重新下载host/desktop4.example.com会成功（server4如果要做客户端，重复一样操作）：

1. [root@desktop4 etc]# ipa-rmkeytab  -p host/desktop4.example.com    -k /etc/krb5.keytab
   

复制代码

1. [root@desktop4 etc]# kinit  admin
   

复制代码

1. [root@desktop4 etc]#ipa-getkeytab   -s classroom.example.com -p host/desktop4.example.com  -k /etc/krb5.keytab

复制代码

之后重启nfs-client.target和nfs-idmapd

waldo

botang 发表于 2020-2-23 15:39
如果重新生成classroom.example.com的krb5.keytab，那么由于其中有随机数，所以：
问题出在nfs客户端这 ...

唐老师，重新抓取key之后依然mount不上去

1. [root@desktop2 ~]# ipa-rmkeytab  -p host/desktop2.example.com    -k /etc/krb5.keytab
   
2. Removing principal host/desktop2.example.com
   
3. [root@desktop2 ~]# ktutil
   
4. ktutil:  read_kt /etc/krb5.keytab
   
5. ktutil:  l
   
6. slot KVNO Principal
   
7. ---- ---- ---------------------------------------------------------------------
   
8. ktutil:  uit
   
9. ktutil: Unknown request "uit".  Type "?" for a request list.
   
10. ktutil:  quit
    
11. [root@desktop2 ~]# kinit admin
    
12. Password for admin@EXAMPLE.COM:
    
13. [root@desktop2 ~]# ipa-getkeytab   -s classroom.example.com -p host/desktop2.example.com  -k /etc/krb5.keytab
    
14. Keytab successfully retrieved and stored in: /etc/krb5.keytab
    
15. [root@desktop2 ~]# ktutil
    
16. ktutil:  read_kt /etc/krb5.keytab
    
17. ktutil:  l
    
18. slot KVNO Principal
    
19. ---- ---- ---------------------------------------------------------------------
    
20.    1    3    host/desktop2.example.com@EXAMPLE.COM
    
21.    2    3    host/desktop2.example.com@EXAMPLE.COM
    
22. ktutil:  quit
    
23. [root@desktop2 ~]# systemctl restart nfs-client.target
    
24. [root@desktop2 ~]# systemctl restart nfs-idmapd
    
25. [root@desktop2 ~]# systemctl restart autofs
    
26. [root@desktop2 ~]# ssh ldapuser2@desktop2.example.com
    
27. Password:
    
28. Activate the web console with: systemctl enable --now cockpit.socket
    
29. 
    
30. Last login: Sun Feb 23 16:16:15 2020 from 192.168.0.2
    
31. Could not chdir to home directory /home/guests/ldapuser2: No such file or directory
    
32. [ldapuser2@desktop2 /]$ exit
    
33. logout
    
34. Connection to desktop2.example.com closed.
    
35. [root@desktop2 ~]# showmount -e classroom.example.com
    
36. Export list for classroom.example.com:
    
37. /home/guests 192.168.0.0/255.255.255.0
    
38. /var/ftp/pub 192.168.1.0/255.255.255.0,192.168.0.0/255.255.255.0
    
39. [root@desktop2 ~]# mount -o sec=krb5p classroom.example.com:/home/guests/ldapuser2/ /mnt
    
40. mount.nfs: access denied by server while mounting classroom.example.com:/home/guests/ldapuser2/
    
41. [root@desktop2 ~]# mount -o sec=krb5p classroom.example.com:/home/guests /mnt           
    
42. mount.nfs: access denied by server while mounting classroom.example.com:/home/guests
    
43. [root@desktop2 ~]# mount -o sec=krb5p classroom.example.com:/home/guests /mnt
    
44. mount.nfs: access denied by server while mounting classroom.example.com:/home/guests
    
45. [root@desktop2 ~]#

复制代码

日志：

1. Last login: Sun Feb 23 16:52:40 2020 from 192.168.0.1
   
2. [root@desktop2 ~]# rpc.gssd -v -v -v -v -v -f
   
3. doing a full rescan
   
4. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt177) ev->mask (0x40000100)
   
5. inotify event for clntdir (nfs/clnt177) - ev->wd (11) ev->name (idmap) ev->mask (0x00000100)
   
6. handle_gssd_upcall: 'mech=krb5 uid=0 service=* enctypes=18,17,16,23,3,1,2 ' (nfs/clnt177)
   
7. krb5_use_machine_creds: uid 0 tgtname (null)
   
8. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=* srchost=(null)
   
9. Full hostname for 'classroom.example.com' is 'classroom.example.com'
   
10. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
    
11. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
    
12. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
    
13. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
    
14. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
    
15. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
    
16. gssd_get_single_krb5_cred: principal 'host/desktop2.example.com@EXAMPLE.COM' ccache:'FILE:/tmp/krb5ccmachine_EXAMPLE.COM'
    
17. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
    
18. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
    
19. creating tcp client for server classroom.example.com
    
20. DEBUG: port already set to 2049
    
21. creating context with server nfs@classroom.example.com
    
22. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
    
23. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
    
24. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
    
25. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=* srchost=(null)
    
26. Full hostname for 'classroom.example.com' is 'classroom.example.com'
    
27. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
    
28. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
    
29. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
    
30. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
    
31. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
    
32. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
    
33. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
    
34. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
    
35. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
    
36. creating tcp client for server classroom.example.com
    
37. DEBUG: port already set to 2049
    
38. creating context with server nfs@classroom.example.com
    
39. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
    
40. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
    
41. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
    
42. doing error downcall
    
43. WARNING: gssd_clnt_gssd_cb: failed reading request
    
44. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt178) ev->mask (0x40000100)
    
45. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt179) ev->mask (0x40000100)
    
46. handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clnt177)
    
47. krb5_use_machine_creds: uid 0 tgtname (null)
    
48. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
    
49. Full hostname for 'classroom.example.com' is 'classroom.example.com'
    
50. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
    
51. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
    
52. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
    
53. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
    
54. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
    
55. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
    
56. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
    
57. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
    
58. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
    
59. creating tcp client for server classroom.example.com
    
60. DEBUG: port already set to 2049
    
61. creating context with server nfs@classroom.example.com
    
62. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
    
63. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
    
64. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
    
65. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
    
66. Full hostname for 'classroom.example.com' is 'classroom.example.com'
    
67. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
    
68. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
    
69. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
    
70. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
    
71. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
    
72. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
    
73. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
    
74. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
    
75. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
    
76. creating tcp client for server classroom.example.com
    
77. DEBUG: port already set to 2049
    
78. creating context with server nfs@classroom.example.com
    
79. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
    
80. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
    
81. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
    
82. doing error downcall
    
83. inotify event for clntdir (nfs/clnt179) - ev->wd (13) ev->name (info) ev->mask (0x00000200)
    
84. inotify event for clntdir (nfs/clnt179) - ev->wd (13) ev->name (<?>) ev->mask (0x00008000)
    
85. inotify event for clntdir (nfs/clnt177) - ev->wd (11) ev->name (idmap) ev->mask (0x00000200)
    
86. inotify event for clntdir (nfs/clnt178) - ev->wd (12) ev->name (info) ev->mask (0x00000200)
    
87. inotify event for clntdir (nfs/clnt177) - ev->wd (11) ev->name (krb5) ev->mask (0x00000200)
    
88. inotify event for clntdir (nfs/clnt177) - ev->wd (11) ev->name (gssd) ev->mask (0x00000200)
    
89. inotify event for clntdir (nfs/clnt177) - ev->wd (11) ev->name (info) ev->mask (0x00000200)
    
90. inotify event for clntdir (nfs/clnt178) - ev->wd (12) ev->name (<?>) ev->mask (0x00008000)
    
91. inotify event for clntdir (nfs/clnt177) - ev->wd (11) ev->name (<?>) ev->mask (0x00008000)
    
92. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt17a) ev->mask (0x40000100)
    
93. inotify event for clntdir (nfs/clnt17a) - ev->wd (14) ev->name (idmap) ev->mask (0x00000100)
    
94. handle_gssd_upcall: 'mech=krb5 uid=0 service=* enctypes=18,17,16,23,3,1,2 ' (nfs/clnt17a)
    
95. krb5_use_machine_creds: uid 0 tgtname (null)
    
96. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=* srchost=(null)
    
97. Full hostname for 'classroom.example.com' is 'classroom.example.com'
    
98. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
    
99. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
    
100. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
101. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
102. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
103. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
104. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
105. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
     
106. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
107. creating tcp client for server classroom.example.com
     
108. DEBUG: port already set to 2049
     
109. creating context with server nfs@classroom.example.com
     
110. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
111. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
112. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
     
113. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=* srchost=(null)
     
114. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
115. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
116. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
117. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
118. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
119. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
120. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
121. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
122. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
     
123. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
124. creating tcp client for server classroom.example.com
     
125. DEBUG: port already set to 2049
     
126. creating context with server nfs@classroom.example.com
     
127. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
128. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
129. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
     
130. doing error downcall
     
131. WARNING: gssd_clnt_gssd_cb: failed reading request
     
132. handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clnt17a)
     
133. krb5_use_machine_creds: uid 0 tgtname (null)
     
134. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
135. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
136. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
137. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
138. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
139. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
140. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
141. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
142. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
143. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
     
144. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
145. creating tcp client for server classroom.example.com
     
146. DEBUG: port already set to 2049
     
147. creating context with server nfs@classroom.example.com
     
148. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
149. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
150. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
     
151. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
152. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
153. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
154. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
155. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
156. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
157. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
158. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
159. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
160. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
     
161. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
162. creating tcp client for server classroom.example.com
     
163. DEBUG: port already set to 2049
     
164. creating context with server nfs@classroom.example.com
     
165. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
166. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
167. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
     
168. doing error downcall
     
169. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt17b) ev->mask (0x40000100)
     
170. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt17c) ev->mask (0x40000100)
     
171. handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clnt17a)
     
172. krb5_use_machine_creds: uid 0 tgtname (null)
     
173. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
174. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
175. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
176. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
177. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
178. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
179. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
180. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
181. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
182. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
     
183. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
184. creating tcp client for server classroom.example.com
     
185. DEBUG: port already set to 2049
     
186. creating context with server nfs@classroom.example.com
     
187. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
188. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
189. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
     
190. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
191. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
192. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
193. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
194. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
195. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
196. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
197. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
198. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
199. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
     
200. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
201. creating tcp client for server classroom.example.com
     
202. DEBUG: port already set to 2049
     
203. creating context with server nfs@classroom.example.com
     
204. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
205. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
206. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
     
207. doing error downcall
     
208. inotify event for clntdir (nfs/clnt17c) - ev->wd (16) ev->name (info) ev->mask (0x00000200)
     
209. inotify event for clntdir (nfs/clnt17c) - ev->wd (16) ev->name (<?>) ev->mask (0x00008000)
     
210. inotify event for clntdir (nfs/clnt17a) - ev->wd (14) ev->name (idmap) ev->mask (0x00000200)
     
211. inotify event for clntdir (nfs/clnt17b) - ev->wd (15) ev->name (info) ev->mask (0x00000200)
     
212. inotify event for clntdir (nfs/clnt17a) - ev->wd (14) ev->name (krb5) ev->mask (0x00000200)
     
213. inotify event for clntdir (nfs/clnt17a) - ev->wd (14) ev->name (gssd) ev->mask (0x00000200)
     
214. inotify event for clntdir (nfs/clnt17b) - ev->wd (15) ev->name (<?>) ev->mask (0x00008000)
     
215. inotify event for clntdir (nfs/clnt17a) - ev->wd (14) ev->name (info) ev->mask (0x00000200)
     
216. inotify event for clntdir (nfs/clnt17a) - ev->wd (14) ev->name (<?>) ev->mask (0x00008000)
     
217. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt17d) ev->mask (0x40000100)
     
218. inotify event for clntdir (nfs/clnt17d) - ev->wd (17) ev->name (gssd) ev->mask (0x00000100)
     
219. inotify event for clntdir (nfs/clnt17d) - ev->wd (17) ev->name (krb5) ev->mask (0x00000100)
     
220. inotify event for clntdir (nfs/clnt17d) - ev->wd (17) ev->name (idmap) ev->mask (0x00000100)
     
221. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt17e) ev->mask (0x40000100)
     
222. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt17f) ev->mask (0x40000100)
     
223. inotify event for clntdir (nfs/clnt17f) - ev->wd (19) ev->name (info) ev->mask (0x00000200)
     
224. inotify event for clntdir (nfs/clnt17f) - ev->wd (19) ev->name (<?>) ev->mask (0x00008000)
     
225. inotify event for clntdir (nfs/clnt17d) - ev->wd (17) ev->name (idmap) ev->mask (0x00000200)
     
226. inotify event for clntdir (nfs/clnt17e) - ev->wd (18) ev->name (info) ev->mask (0x00000200)
     
227. inotify event for clntdir (nfs/clnt17d) - ev->wd (17) ev->name (krb5) ev->mask (0x00000200)
     
228. inotify event for clntdir (nfs/clnt17d) - ev->wd (17) ev->name (gssd) ev->mask (0x00000200)
     
229. inotify event for clntdir (nfs/clnt17d) - ev->wd (17) ev->name (info) ev->mask (0x00000200)
     
230. inotify event for clntdir (nfs/clnt17d) - ev->wd (17) ev->name (<?>) ev->mask (0x00008000)
     
231. inotify event for clntdir (nfs/clnt17e) - ev->wd (18) ev->name (<?>) ev->mask (0x00008000)
     
232. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt180) ev->mask (0x40000100)
     
233. inotify event for topdir (nfs) - ev->wd (8) ev->name (clnt181) ev->mask (0x40000100)
     
234. inotify event for clntdir (nfs/clnt180) - ev->wd (20) ev->name (gssd) ev->mask (0x00000100)
     
235. inotify event for clntdir (nfs/clnt180) - ev->wd (20) ev->name (krb5) ev->mask (0x00000100)
     
236. handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clnt180)
     
237. krb5_use_machine_creds: uid 0 tgtname (null)
     
238. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
239. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
240. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
241. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
242. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
243. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
244. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
245. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
246. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
247. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
     
248. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
249. creating tcp client for server classroom.example.com
     
250. DEBUG: port already set to 2049
     
251. creating context with server nfs@classroom.example.com
     
252. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
253. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
254. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
     
255. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
256. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
257. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
258. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
259. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
260. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
261. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
262. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
263. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
264. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
     
265. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
266. creating tcp client for server classroom.example.com
     
267. DEBUG: port already set to 2049
     
268. creating context with server nfs@classroom.example.com
     
269. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
270. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
271. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
     
272. doing error downcall
     
273. handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clnt180)
     
274. krb5_use_machine_creds: uid 0 tgtname (null)
     
275. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
276. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
277. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
278. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
279. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
280. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
281. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
282. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
283. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
284. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
     
285. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
286. creating tcp client for server classroom.example.com
     
287. DEBUG: port already set to 2049
     
288. creating context with server nfs@classroom.example.com
     
289. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
290. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
291. WARNING: Machine cache prematurely expired or corrupted trying to recreate cache for server classroom.example.com
     
292. gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
     
293. Full hostname for 'classroom.example.com' is 'classroom.example.com'
     
294. Full hostname for 'desktop2.example.com' is 'desktop2.example.com'
     
295. No key table entry found for desktop2$@EXAMPLE.COM while getting keytab entry for 'desktop2$@EXAMPLE.COM'
     
296. No key table entry found for DESKTOP2$@EXAMPLE.COM while getting keytab entry for 'DESKTOP2$@EXAMPLE.COM'
     
297. No key table entry found for root/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop2.example.com@EXAMPLE.COM'
     
298. No key table entry found for nfs/desktop2.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop2.example.com@EXAMPLE.COM'
     
299. Success getting keytab entry for 'host/desktop2.example.com@EXAMPLE.COM'
     
300. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
301. gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7fb134001e60 service=(null) srchost=(null)
     
302. INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582534867
     
303. creating tcp client for server classroom.example.com
     
304. DEBUG: port already set to 2049
     
305. creating context with server nfs@classroom.example.com
     
306. WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
     
307. WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
     
308. ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
     
309. doing error downcall
     
310. inotify event for clntdir (nfs/clnt180) - ev->wd (20) ev->name (krb5) ev->mask (0x00000200)
     
311. inotify event for clntdir (nfs/clnt180) - ev->wd (20) ev->name (gssd) ev->mask (0x00000200)
     
312. inotify event for clntdir (nfs/clnt181) - ev->wd (21) ev->name (info) ev->mask (0x00000200)
     
313. inotify event for clntdir (nfs/clnt180) - ev->wd (20) ev->name (info) ev->mask (0x00000200)
     
314. inotify event for clntdir (nfs/clnt180) - ev->wd (20) ev->name (<?>) ev->mask (0x00008000)
     
315. inotify event for clntdir (nfs/clnt181) - ev->wd (21) ev->name (<?>) ev->mask (0x00008000)
     

复制代码

botang

waldo 发表于 2020-2-23 16:07
唐老师，重新抓取key之后依然mount不上去日志：

如果能挂上，日志应该这样：
DEBUG: port already set to 2049
creating context with server nfs@classroom.example.com
DEBUG: serialize_krb5_ctx: lucid version!
prepare_krb5_rfc4121_buffer: protocol 1
prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32
doing downcall: lifetime_rec=86025 acceptor=nfs@classroom.example.com
inotify event for topdir (nfs) - ev->wd (8) ev->name (clntbc) ev->mask (0x40000100)
inotify event for topdir (nfs) - ev->wd (8) ev->name (clntbd) ev->mask (0x40000100)
inotify event for topdir (nfs) - ev->wd (8) ev->name (clntbe) ev->mask (0x40000100)
inotify event for clntdir (nfs/clntbd) - ev->wd (16) ev->name (info) ev->mask (0x00000200)
inotify event for clntdir (nfs/clntbd) - ev->wd (16) ev->name (<?>) ev->mask (0x00008000)
inotify event for topdir (nfs) - ev->wd (8) ev->name (clntbf) ev->mask (0x40000100)
handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' (nfs/clntbb)
krb5_use_machine_creds: uid 0 tgtname (null)
gssd_refresh_krb5_machine_credential: hostname=classroom.example.com ple=(nil) service=(null) srchost=(null)
Full hostname for 'classroom.example.com' is 'classroom.example.com'
Full hostname for 'desktop4.example.com' is 'desktop4.example.com'
No key table entry found for desktop4$@EXAMPLE.COM while getting keytab entry for 'desktop4$@EXAMPLE.COM'
No key table entry found for DESKTOP4$@EXAMPLE.COM while getting keytab entry for 'DESKTOP4$@EXAMPLE.COM'
No key table entry found for root/desktop4.example.com@EXAMPLE.COM while getting keytab entry for 'root/desktop4.example.com@EXAMPLE.COM'
No key table entry found for nfs/desktop4.example.com@EXAMPLE.COM while getting keytab entry for 'nfs/desktop4.example.com@EXAMPLE.COM'
Success getting keytab entry for 'host/desktop4.example.com@EXAMPLE.COM'
INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582537234
gssd_refresh_krb5_machine_credential: hostname=(null) ple=0x7f31bc001e60 service=(null) srchost=(null)
INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_EXAMPLE.COM' are good until 1582537234
creating tcp client for server classroom.example.com
DEBUG: port already set to 2049
creating context with server nfs@classroom.example.com
DEBUG: serialize_krb5_ctx: lucid version!
prepare_krb5_rfc4121_buffer: protocol 1
prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32
doing downcall: lifetime_rec=86009 acceptor=nfs@classroom.example.com
inotify event for clntdir (nfs/clntbf) - ev->wd (18) ev->name (info) ev->mask (0x00000200)
inotify event for clntdir (nfs/clntbf) - ev->wd (18) ev->name (<?>) ev->mask (0x00008000)
inotify event for topdir (nfs) - ev->wd (8) ev->name (clntc0) ev->mask (0x40000100)
WARNING: gssd_clnt_gssd_cb: failed reading request
inotify event for topdir (nfs) - ev->wd (8) ev->name (clntc1) ev->mask (0x40000100)
inotify event for clntdir (nfs/clntc0) - ev->wd (19) ev->name (info) ev->mask (0x00000200)
inotify event for clntdir (nfs/clntc0) - ev->wd (19) ev->name (<?>) ev->mask (0x00008000)
inotify event for clntdir (nfs/clntbe) - ev->wd (17) ev->name (info) ev->mask (0x00000200)
inotify event for clntdir (nfs/clntbe) - ev->wd (17) ev->name (<?>) ev->mask (0x00008000)
inotify event for clntdir (nfs/clntbc) - ev->wd (15) ev->name (info) ev->mask (0x00000200)
inotify event for clntdir (nfs/clntbc) - ev->wd (15) ev->name (<?>) ev->mask (0x00008000)-----------------------------------------------------------------------------------------------------------------------------------
所以你的日志中这里有问题：

• WARNING: Failed to create krb5 context for user with uid 0 for server nfs@classroom.example.com
• WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_EXAMPLE.COM for server classroom.example.com
• ERROR: Failed to create machine krb5 context with any credentials cache for server classroom.example.com
  

waldo

botang 发表于 2020-2-23 17:43
如果能挂上，日志应该这样：
DEBUG: port already set to 2049
creating context with server nfs@clas ...

同样的文件同样的指令server2就能挂上去，删除原有key重新获取也没问题， 但是desktop2重做多次都不行
-----------------------------------------------------------------------------------------------------------------

解决了，不知道desktop那边的keytab出了什么问题，要在classroom生成之后传过去才行

botang

waldo 发表于 2020-2-23 18:43
同样的文件同样的指令server2就能挂上去，删除原有key重新获取也没问题， 但是desktop2重做多次都不行
- ...

好的，实在不行，也可以用RHEL7的土办法“ktadd -randkey”的krb5.key来生成ipa的keytab ，一样成功的。因为原理和kerberos都是一样，就像单独点餐和套餐中的鸡腿都是一种鸡腿一样。这种土办法，在生产环境中用过！！！！因为大家刚开始其实对IPA的命令都不熟悉，能解决问题就行。