test

System Administration Guide: Security Services

How to Configure SEAM NFS Servers

In this procedure, the following configuration parameters are used:

  1. Complete the prerequisites for configuring a SEAM NFS server.

    The master KDC must be configured. To fully test the process, you need several clients.

  2. (Optional) Install the NTP client or other clock synchronization mechanism.

    It is not required to install and use the Network Time Protocol (NTP). However, every clock must be within the default time that is defined in the libdefaults section of the krb5.conf file in order for authentication to succeed. See Synchronizing Clocks between KDCs and SEAM Clients for information about NTP.

  3. Start kadmin.

    You can use the SEAM Administration Tool to add a principal, as explained in How to Create a New Principal. To do so, you must log on with one of the admin principal names that you created when you configured the master KDC. However, the following example shows how to add the required principals by using the command line. 


    denver # /usr/sbin/kadmin -p kws/admin
Enter password: <Type kws/admin password>
kadmin:

    1. Create the server's NFS service principal.

      Note that when the principal instance is a host name, the FQDN must be entered in lowercase letters, regardless of the case of the domainname in the /etc/resolv.conf file.


      kadmin: addprinc -randkey nfs/denver.example.com
Principal "nfs/denver.example.com" created.
kadmin:

    2. (Optional) Create a root principal for the NFS server.


      kadmin: addprinc root/denver.example.com
Enter password for principal root/denver.example.com@EXAMPLE.COM: <type the password>
Re-enter password for principal root/denver.example.com@EXAMPLE.COM: <type it again>
Principal "root/denver.example.com@EXAMPLE.COM" created.
kadmin:

    3. Add the server's NFS service principal to the server's keytab file.


      kadmin: ktadd nfs/denver.example.com
kadmin: Entry for principal nfs/denver.example.com with
  kvno 3, encryption type DES-CBC-CRC added to keytab
  WRFILE:/etc/krb5/krb5.keytab
kadmin:

    4. Quit kadmin.


      kadmin: quit

  4. Create the gsscred table.

    See How to Create a Credential Table for more information.

  5. Share the NFS file system with Kerberos security modes.

    See How to Set Up a Secure NFS Environment With Multiple Kerberos Security Modes for more information.

  6. On each client, authenticate both the user principal and the root principal.