I've been fighting this for days and I'm lucky the windows don't open too wide ;-). I'm putting together a new infra and am trying to get NFS automounts running on Ubuntu working with with FreeIPA, also on Ubuntu. I have the identify and nameserving working just fine; I can do an "id student" (student being my test user) on both the NFS server and the client machine, and I get the same values for uid, gid, and groups, which are clearly coming from FreeIPA. I can ssh into a test client machine as student where the account isn't defined and use the password from FreeIPA to get on.

Here's where it gets weird: "student" is being denied access to his home directory, although attempting to access it does cause it to automount. If I make any attempt to access /home/student as any user besides root (including user "student"), I get permission denied. Root, however, can see it and have a look around inside if desired. Stranger still, running 'df' as student shows just the local mounts, but 'df' as root at the same time shows the NFS mounted /home/student along with everything else:

mounted home invisible to owner, only visible to root

Among other resources, I've mainly been using this to guide me on using FreeIPA with NFS on Ubuntu

My NFS server's /etc/exports contains:

/home    *(rw,sec=sys:krb5:krb5i:krb5p)

My I added the following line to my client's /etc/auto.master:

/home    /etc/auto.home

And auto.home contains this:

*   -fstype=nfs4,rw,sec=krb5,soft,rsize=8192,wsize=8192 nfs.XXXXXX:/home/&

Supposedly ipa-client-automount sets up nsswitch.conf and a couple of other files that don't seem to exist on Ubuntu, so it's difficult to determine the impact. The logs I don't tell me much.

I've looked into Ubuntu's instructions for doing automount with LDAP, but it appears like it will require changes that make break use with FreeIPA.

I feel like I'm pretty close here; the mounts happen, but somewhere the user's identity appears to get lost and permissions are granted to see files that should otherwise be fine to see. Does this sound like something familiar?

  • Some new clues-- in exports, I changed sec to just be sys:krb5. After fiddling around a bit, a client sudden worked. But I had seen this before, so I decided to reboot and try again. After booting, it once again didn't work. So I'm suspecting that perhaps there may be a clock problem? – Haxsaw Aug 27 '17 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.