Good morning sysadmins, I'm currently in contact with ID to get the cifs mount working from nas-nethz-users.d.ethz.ch using root@sgv-ubuntu-01:~# mount -t cifs -w -o sec=krb5,user=nicosc,domain=d.ethz.ch,uid=0,gid=0 '//nas-nethz-users.d.ethz.ch/share-n-$' /mnt though still without success, although the kerberos tickets seem to available: root@sgv-ubuntu-01:~# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: nicosc@D.ETHZ.CH Valid starting Expires Service principal 08/30/10 17:52:10 08/31/10 03:52:13 krbtgt/D.ETHZ.CH@D.ETHZ.CH renew until 09/06/10 17:52:10 08/30/10 17:52:52 08/31/10 03:52:13 cifs/nas-nethz-users.d.ethz.ch@D.ETHZ.CH renew until 09/06/10 17:52:10 If anyone of you had success or knows someone who had success in mounting the cifs home via kerberos, please let me know. If you're interested in getting that stuff to work, a ping would also be great, because ID is quite unaware of any possible users and presumably not very motivated if only one party is interested. Cheers, Nico -- Systems Group Sysadmin Tel: +41 (0) 44 632 76 09 D-INFK/ETH Zurich
Hi Nico, what does klist -kte give you? And if it contains "(DES cbc mode ..." then are you aware of the W2008R2 moves going on? Quote : "WICHTIG: Am 15. Oktober 2010 wird auf allen Domänen Kontroller die DES Verschlüsselung, per GPO vorübergehend, bis am 31.3.2011 aktiviert." Best Kai On 9/1/10 10:17 AM, "Nico Schottelius" <nico.schottelius@inf.ethz.ch> wrote: Good morning sysadmins, I'm currently in contact with ID to get the cifs mount working from nas-nethz-users.d.ethz.ch using root@sgv-ubuntu-01:~# mount -t cifs -w -o sec=krb5,user=nicosc,domain=d.ethz.ch,uid=0,gid=0 '//nas-nethz-users.d.ethz.ch/share-n-$' /mnt though still without success, although the kerberos tickets seem to available: root@sgv-ubuntu-01:~# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: nicosc@D.ETHZ.CH Valid starting Expires Service principal 08/30/10 17:52:10 08/31/10 03:52:13 krbtgt/D.ETHZ.CH@D.ETHZ.CH renew until 09/06/10 17:52:10 08/30/10 17:52:52 08/31/10 03:52:13 cifs/nas-nethz-users.d.ethz.ch@D.ETHZ.CH renew until 09/06/10 17:52:10 If anyone of you had success or knows someone who had success in mounting the cifs home via kerberos, please let me know. If you're interested in getting that stuff to work, a ping would also be great, because ID is quite unaware of any possible users and presumably not very motivated if only one party is interested. Cheers, Nico -- Systems Group Sysadmin Tel: +41 (0) 44 632 76 09 D-INFK/ETH Zurich
Hey Kai, Mosebach Kai [Wed, Sep 01, 2010 at 10:46:33AM +0200]:
klist -kte
give you? And if it contains "(DES cbc mode ..." then are you aware of the W2008R2 moves going on?
root@sgv-ubuntu-01:~# klist -e Ticket cache: FILE:/tmp/krb5cc_0 Default principal: nicosc@D.ETHZ.CH Valid starting Expires Service principal 08/30/10 17:52:10 08/31/10 03:52:13 krbtgt/D.ETHZ.CH@D.ETHZ.CH renew until 09/06/10 17:52:10, Etype (skey, tkt): ArcFour with HMAC/md5, ArcFour with HMAC/md5 08/30/10 17:52:52 08/31/10 03:52:13 cifs/nas-nethz-users.d.ethz.ch@D.ETHZ.CH renew until 09/06/10 17:52:10, Etype (skey, tkt): ArcFour with HMAC/md5, ArcFour with HMAC/md5 root@sgv-ubuntu-01:~# root@sgv-ubuntu-01:~# klist -kte Keytab name: WRFILE:/etc/krb5.keytab klist: No such file or directory while starting keytab scan -> keine no keytab here
Quote : "WICHTIG: Am 15. Oktober 2010 wird auf allen Domänen Kontroller die DES Verschlüsselung, per GPO vorübergehend, bis am 31.3.2011 aktiviert."
Could be part of the problem. Together with ID I found some more information, Marcus Moeller at ID and Stefan Metzmacher from Sernet are debugging the same problem: https://bugzilla.redhat.com/show_bug.cgi?id=622790 So, stay tuned, hopefully the problem will be solved soon, either from EMC or MIT-krb side. Cheers, Nico -- Systems Group Sysadmin Tel: +41 (0) 44 632 76 09 D-INFK/ETH Zurich
participants (2)
-
Mosebach Kai -
Nico Schottelius