Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.kernel > #69784 > unrolled thread
| Started by | Joachim Falk <joachim.falk@gmx.de> |
|---|---|
| First post | 2021-03-11 20:30 +0100 |
| Last post | 2023-01-11 22:10 +0100 |
| Articles | 3 — 3 participants |
Back to article view | Back to linux.debian.kernel
Bug#985002: nfs-common: Degraded system state if nfs-common installed and /etc/krb5.keytab present Joachim Falk <joachim.falk@gmx.de> - 2021-03-11 20:30 +0100
Bug#985002: nfs-common: Degraded system state if nfs-common installed and /etc/krb5.keytab present Felix Lechner <felix.lechner@lease-up.com> - 2021-03-13 00:00 +0100
Bug#985002: marked as done (nfs-common: Degraded system state if nfs-common installed and /etc/krb5.keytab present) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2023-01-11 22:10 +0100
| From | Joachim Falk <joachim.falk@gmx.de> |
|---|---|
| Date | 2021-03-11 20:30 +0100 |
| Subject | Bug#985002: nfs-common: Degraded system state if nfs-common installed and /etc/krb5.keytab present |
| Message-ID | <BRzaq-6Oa-3@gated-at.bofh.it> |
[Multipart message — attachments visible in raw view] — view raw
Package: nfs-common
Version: 1:1.3.4-4
Severity: normal
Tags: patch
X-Debbugs-Cc: felix.lechner@lease-up.com
The nfs-client.target requires the auth-rpcgss-module.service, which in
turn requires rpc-svcgssd.service. However, the rpc.svcgssd daemon is
not needed for an NFS client, even when using Kerberos security.
Moreover, starting this daemon with its default configuration will fail
when no nfs/<host>@REALM principal is in the kerberos keytab. Thus,
resulting in a degraded system state for NFS client configurations
without nfs/<host>@REALM principal in the kerberos keytab. However, this
is a perfectly valid NFS client configuration as the nfs/<host>@REALM
principal is not required for mounting NFS file systems. This is even
the case when Kerberos security is enabled for the mount!
Note that installing the gssproxy packed hides this problem as this
disables the rpc-svcgssd.service.
-- Package-specific info:
-- rpcinfo --
program vers proto port service
100000 4 tcp 111 portmapper
100000 3 tcp 111 portmapper
100000 2 tcp 111 portmapper
100000 4 udp 111 portmapper
100000 3 udp 111 portmapper
100000 2 udp 111 portmapper
-- /etc/default/nfs-common --
SMNOTIFYARGS=""
RPCIDMAPDARGS=""
NEED_STATD=
STATDOPTS=
NEED_IDMAPD=
NEED_GSSD=
RPCGSSDOPTS=
-- /etc/idmapd.conf --
[General]
Verbosity = 0
Pipefs-Directory = /run/rpc_pipefs
Domain = jfalk.de
Local-Realms = JFAD.JFALK.DE
[Mapping]
Nobody-User = nobody
Nobody-Group = nogroup
-- /etc/fstab --
nfs.jfalk.de:/home /home nfs4 sec=krb5p,nodev,nosuid,noatime,async 0 0
nfs.jfalk.de:/local /local nfs4 sec=krb5p,nodev,nosuid,noatime,async 0 0
nfs.jfalk.de:/opt /opt nfs4 sec=krb5p,nodev,nosuid,noatime,async 0 0
# the auto mounter map /etc/auto.nfs handles these
#nfs.jfalk.de:/bulk-data /bulk-data nfs4 sec=krb5p,nodev,nosuid,noatime,async 0 0
-- /proc/mounts --
nfs.jfalk.de:/local /local nfs4 rw,nosuid,nodev,noatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=krb5p,clientaddr=192.168.192.128,local_lock=none,addr=192.168.194.37 0 0
nfs.jfalk.de:/opt /opt nfs4 rw,nosuid,nodev,noatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=krb5p,clientaddr=192.168.192.128,local_lock=none,addr=192.168.194.37 0 0
nfs.jfalk.de:/home /home nfs4 rw,nosuid,nodev,noatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=krb5p,clientaddr=192.168.192.128,local_lock=none,addr=192.168.194.37 0 0
/etc/auto.nfs /var/autofs/nfs autofs rw,relatime,fd=6,pgrp=1106,timeout=300,minproto=5,maxproto=5,indirect,pipe_ino=12280 0 0
-- System Information:
Debian Release: bullseye/sid
APT prefers testing
APT policy: (520, 'testing'), (500, 'testing-security')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 5.10.0-4-amd64 (SMP w/8 CPU threads)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages nfs-common depends on:
ii adduser 3.118
ii keyutils 1.6.1-2
ii libc6 2.31-9
ii libcap2 1:2.44-1
ii libcom-err2 1.46.1-1
ii libdevmapper1.02.1 2:1.02.175-2.1
ii libevent-2.1-7 2.1.12-stable-1
ii libgssapi-krb5-2 1.18.3-4
ii libkeyutils1 1.6.1-2
ii libkrb5-3 1.18.3-4
ii libmount1 2.36.1-7
ii libnfsidmap2 0.25-6
ii libtirpc3 1.3.1-1
ii libwrap0 7.6.q-31
ii lsb-base 11.1.0
ii rpcbind 1.2.5-9
ii ucf 3.0043
Versions of packages nfs-common recommends:
pn python <none>
Versions of packages nfs-common suggests:
pn open-iscsi <none>
pn watchdog <none>
-- Configuration Files:
/etc/default/nfs-common changed:
SMNOTIFYARGS=""
RPCIDMAPDARGS=""
NEED_STATD=
STATDOPTS=
NEED_IDMAPD=
NEED_GSSD=
RPCGSSDOPTS=
-- no debconf information
[toc] | [next] | [standalone]
| From | Felix Lechner <felix.lechner@lease-up.com> |
|---|---|
| Date | 2021-03-13 00:00 +0100 |
| Message-ID | <BRYVd-641-5@gated-at.bofh.it> |
| In reply to | #69784 |
Hi, On Thu, Mar 11, 2021 at 11:27 AM Joachim Falk <joachim.falk@gmx.de> wrote: > > gssproxy ... hides this problem Should we recommend, or even require, the use of gssproxy with Kerberos? Then we could keep all keytabs in the single file /etc/krb5.keytab. It would sidestep a huge class of bugs, among them Bug#848306, Bug#849608 and Bug#849942? I added a remark about gssproxy to the Wiki for NFS/Kerberos [1] . Kind regards Felix Lechner [1] https://wiki.debian.org/NFS/Kerberos
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2023-01-11 22:10 +0100 |
| Subject | Bug#985002: marked as done (nfs-common: Degraded system state if nfs-common installed and /etc/krb5.keytab present) |
| Message-ID | <FMQwa-hhWF-25@gated-at.bofh.it> |
| In reply to | #69784 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Wed, 11 Jan 2023 21:07:27 +0000 with message-id <E1pFiJj-0085ca-NA@fasolo.debian.org> and subject line Bug#985002: fixed in nfs-utils 1:2.6.2-4 has caused the Debian Bug report #985002, regarding nfs-common: Degraded system state if nfs-common installed and /etc/krb5.keytab present to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 985002: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985002 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.kernel
csiph-web