AIX NFS Version 4 configuration over Kerberos inter-realm setup

Learn how to configure an inter-realm setup between IBM® Network Authentication Service (IBM NAS) and Microsoft® Active Directory for AIX® Network File System (NFS) Version 4.

Prashant Sodhiya, Staff Software Engineer, IBM

Photo of Prashant SodhiyaPrashant Sodhiya is a Staff Software Engineer for IBM India Software Labs. He has worked for IBM for the past two years and is currently developing new features and product support for the IBM Network Authentication Service (IBM Kerberos). Before joining IBM, he worked with the Centre for Development of Advanced Computing (CDAC) for three years in network security domain. Prashant holds a BS degree in computer science and engineering from the University of Gwalior, India. You can contact him at psodhiya@in.ibm.com.



Sandeep Patil (rsandeep@in.ibm.com), Advisory Software Engineer, IBM

Sandeep Patil photoSandeep Ramesh Patil works as an Advisory Software Engineer for the IBM India Software Labs. He has worked for IBM for the past six years, focusing on distributed technology including DCE, SARPC, and security products, such as the IBM Network Authentication Service (IBM Kerberos). He is currently developing new features and implementing security-related RFC for the IBM Network Authentication Service, along with its product support. Sandeep holds a Bachelor of Engineering degree in computer science from the University of Pune, India. You can contact him at rsandeep@in.ibm.com.



08 January 2008

Also available in Chinese

Introduction

Since security is one of the key aspects and selling features of Network File System Version 4 (NFS Version 4), it is widely being accepted as the next-generation distributed file system. The current implementation of NFS Version 4 makes use of Kerberos (RFC 4120) as its underlying security mechanism to achieve authentication, privacy, integrity, and non-repudiation. IBM® has its own implementation of NFS Version 4 for its AIX® operating system, which makes use of IBM Network Authentication Service Version 1.4 (IBM NAS—the IBM flavor of Kerberos) for kerberizing the file system.

Most of the customers deploying AIX NFS Version 4 (or migrating from an older distributed file system like DCE/DFS or AFS) have a hybrid environment with a mix of Windows® and UNIX® systems. In such a heterogeneous environment, some administrators prefer using Microsoft® Active Directory as the Kerberos server for their Windows environment and using IBM NAS for AIX as the Kerberos server for the rest, thus resulting in two different Kerberos realms. There are also scenarios where there is a need for AIX NFS Version 4 to operate across organizational boundaries. In such cases, there is a high chance that the Kerberos servers used within individual organizations are deployed using different flavors of Kerberos by different vendors (for example, some using IBM NAS and others using Microsoft Active Directory). In other scenarios that are similar, some administrators might be planning to migrate from Microsoft Active Directory to IBM NAS for AIX to act as the Kerberos server for their realm.

In order for AIX NFS Version 4 to work in the scenarios involving multiple Kerberos realms, you need to establish an inter-realm configuration between the Kerberos realms configured using IBM NAS Version 1.4 for AIX and Microsoft Active Directory. This article describes the necessary configuration steps to aid you in configuring a successful inter-realm setup between IBM NAS Version 1.4 and Microsoft Active Directory. It further details the changes required for AIX NFS Version 4 to work over such an inter-realm setup and illustrates its working through examples.

Kerberos inter-realm configuration

The Kerberos Version 5 protocol is implemented by various vendors for a variety of systems. Its basic use is to achieve centralized authentication over a distributed network. Kerberos interoperability provides a common protocol for various implementations to coexist and work together in a heterogeneous environment.

In the Kerberos world, all the users and applications that use Kerberos as the authentication medium and which are configured to a particular Kerberos server (say either IBM NAS Version 1.4 for AIX or Microsoft Active Directory) together compose a cell called realm. The name of the realm in which a Kerberos client (user or application) gets registered is part of the client's name and can be used by the kerberized application server to decide whether to honor a request. As a part of Kerberos interoperability, most of the Kerberos implementation supports a theory called inter-realm configuration. The basic concept behind inter-realm configuration is the establishment of inter-realm keys, which aid administrators of two different realms to allow clients authenticated in one realm to use its Kerberos credentials in other realm.

The following sections describe the configuration details on how to set up an inter-realm between two Kerberos realms, one configured to IBM NAS servers and the other to Microsoft Active Directory. It further explains the use of AIX NFS Version 4 as the kerberized application to test the working of inter-realm configuration.

AIX NFS Version 4 with IBM NAS and Microsoft Active Directory—The scenario

In order to set up and test the execution of AIX NFS Version 4 over the Kerberos inter-realm consisting of IBM NAS and Microsoft Active Directory, consider the following scenario. As shown in Figure 1, the scenario consists of two different Kerberos realms. One of the realms, ADFSAIX1.IN.IBM.COM, has IBM NAS for AIX acting as the Kerberos Key Distribution Center (KDC), while the other realm, MSKERBEROS.IN.IBM.COM, makes use of Microsoft Active Directory as the Kerberos KDC. The AIX NFS Version 4 server exporting the directories is configured to the IBM NAS realm, ADFSAIX1.IN.IBM.COM, while the AIX NFS Version 4 client, which mounts the exported directories by AIX NFS V4 server, is configured to both the ADFSAIX1.IN.IBM.COM and MSKERBEROS.IN.IBM.COM Kerberos realms. The final goal that defines the success of this scenario is that an administrator@ MSKERBEROS.IN.IBM.COM Kerberos principal, belonging to MSKERBEROS.IN.IBM.COM realm, should be able to successfully acquire Kerberos credentials on the AIX NFS Version 4 client machine and use those credentials to successfully access and mount the directories exported by the AIX NFS Version 4 nfs/adfsaix1.in.ibm.com@ ADFSAIX1.IN.IBM.COMserver, belonging to the ADFSAIX1.IN.IBM.COM realm.

The following definitions are used in the example in this article:

Listing 1. Definitions
        NFS domain name: in.ibm.com

        AIX NAS 1.4 (KDC) and AIX NFS V4 server:
        Realm name              : ADFSAIX1.IN.IBM.COM
        Hostname                : adfsaix1.in.ibm.com
        Operating system        : AIX V5.3
        IBM NAS admin principal : admin/admin
        NFS V4 Server principal : nfs/adfsaix1.in.ibm.com

        Microsoft Active Directory Server (KDC)
        Realm Name             : MSKERBEROS.IN.IBM.COM
        Hostname               : windce20.in.ibm.com
        Operating system       : Microsoft Windows Server 2003
        (Enterprise Edition, SP1)
        Active Directory admin
        Principal              : administrator

        AIX NAS 1.4 client and AIX NFS V4 client
        Realm name       : ADFSAIX1.IN.IBM.COM
        Hostname         : nfsaix02.in.ibm.com
        Operating system : AIX V5.3
        Configured to ADFSAIX1.IN.IBM.COM and MSKERBEROS.IN.IBM.COM realms.
Figure 1. Example setup
Figure 1. Example Setup

Configuration steps

For a better understanding, the configuration steps are divided into four distinct modules:

Setting up IBM NAS KDC server and AIX NFS Version 4 server

  1. Install krb5 and the modcrypt filesets on the AIX 5.3 machine.

    The IBM NAS Version 1.4 filesets are shipped with the AIX Version 5.3 Expansion CD. The commands to install IBM NAS Version 1.4 server and the modcrypt.base fileset required by AIX NFS Version 4 are:

    Listing 2. Fileset requirements
            bash-2.05b#  hostname
            adfsaix1.in.ibm.com
    
            bash-2.05b#  installp -aqXgd . krb5.server modcrypt.base

    With the release of AIX 53L (TL 5300-07) and AIX 610, you need to also install the clic.rte fileset shipped with the AIX Expansion Pack CD, which is the prerequisite for the execution of the gssd daemon. For more information, please refer to the AIX 53L or 610 documentation.

  2. Configure the AIX NAS KDC server.

    After successfully installing IBM NAS Version 1.4, configure the IBM NAS KDC on the AIX machine. To configure the NAS KDC server to use the legacy database, use the following command, as shown in Listing 3 . For detailed information on IBM NAS administration, please refer to the IBM NAS Version 1.4 Administration’s and User’s Guide, shipped with the AIX Version 5.3 Expansion Pack CD.

    Listing 3. Configuration of the NAS KDC server
         bash-2.05b#  hostname
         adfsaix1.in.ibm.com
    
         bash-2.05b# export PATH=/usr/krb5/bin/:/usr/krb5/sbin/:$PATH
    
         bash-2.05b# config.krb5 -S -r ADFSAIX1.IN.IBM.COM -d in.ibm.com
         Initializing configuration...
         Creating /etc/krb5/krb5_cfg_type...
         Creating /etc/krb5/krb5.conf...
         Creating /var/krb5/krb5kdc/kdc.conf...
         Creating database files...
         Initializing database '/var/krb5/krb5kdc/principal' for realm 'ADFSAIX1.IN.IBM.COM'
         master key name 'K/M@ADFSAIX1.IN.IBM.COM'
         You are prompted for the database Master Password.
         It is important that you DO NOT FORGET this password.
         Enter database Master Password:
         Re-enter database Master Password to verify:
         WARNING: no policy specified for admin/admin@ADFSAIX1.IN.IBM.COM;
         defaulting to no policy. Note that policy may be overridden by
         ACL restrictions.
         Enter password for principal "admin/admin@ADFSAIX1.IN.IBM.COM":
         Re-enter password for principal "admin/admin@ADFSAIX1.IN.IBM.COM":
         Principal "admin/admin@ADFSAIX1.IN.IBM.COM" created.
         Creating keytable...
         Creating /var/krb5/krb5kdc/kadm5.acl...
         Starting krb5kdc...
         krb5kdc was started successfully.
         Starting kadmind...
         kadmind was started successfully.
         The command completed successfully.

    You can also configure the NAS KDC server using the AIX mkkrb5srv command. For more information, please refer to mkkrb5srv man page.

    While running this command, the system asks for a master database password and a password for the administrative principal called admin. Record the name and chosen password in a secure place, as these principals are essential for your NAS environment.

  3. Set up the NFS domain name.

    You must have the NFS domain name set before you can use NFS Version 4.

    Listing 4. NFS setup server
            bash-2.05b#  hostname
            adfsaix1.in.ibm.com
    
            bash-2.05b# chnfsdom 	in.ibm.com
    
            bash-2.05b# chnfsdom
            Current local domain: in.ibm.com
  4. Add NFS domain-to-realm mapping on the NFS Version 4 server.

    In the AIX 5.3 implementation of NFS Version 4, you need to have a cross-relation definition between the NFS domain and the Kerberos realm that is used.

    Listing 5. NFS domain-to-realm mapping
            bash-2.05b#  hostname
            adfsaix1.in.ibm.com
    
            bash-2.05b# chnfsrtd -a ADFSAIX1.IN.IBM.COM   in.ibm.com
            bash-2.05b# chnfsrtd -a MSKERBEROS.IN.IBM.COM in.ibm.com
    
            bash-2.05b# chnfsrtd
            adfsaix1.in.ibm.com		in.ibm.com
            mskerberos.in.ibm.com	in.ibm.com
  5. Create the NFS server principal on AIX KDC and then create the NFS server keytab file entry.

    For each NFS server in your KDC environment, you must define a principal of type nfs/<full_qualified_hostname>@REALM, and then create the server keytab file entry, as follows:

    Listing 6. Creating the NFS server principal
         bash-2.05b#  hostname
         adfsaix1.in.ibm.com
    
    
         bash-2.05b# kadmin.local
         kadmin.local:  ank nfs/adfsaix1.in.ibm.com
         WARNING: no policy specified for nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM;
         defaulting to no policy. Note that policy may be overridden by
         ACL restrictions.
         Enter password for principal "nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM":
         Re-enter password for principal "nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM":
         Principal "nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM" created.
    
         kadmin.local:
         kadmin.local:  ktadd nfs/adfsaix1.in.ibm.com
         Entry for principal nfs/adfsaix1.in.ibm.com with kvno 2, encryption type Triple DES
    cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5/krb5.keytab.
         Entry for principal nfs/adfsaix1.in.ibm.com with kvno 2, encryption type ArcFour
    with HMAC/md5 added to keytab WRFILE:/etc/krb5/krb5.keytab.
         Entry for principal nfs/adfsaix1.in.ibm.com with kvno 2, encryption type AES-256
    CTS mode with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/krb5/krb5.keytab.
         Entry for principal nfs/adfsaix1.in.ibm.com with kvno 2, encryption type DES cbc
    mode with RSA-MD5 added to keytab WRFILE:/etc/krb5/krb5.keytab.
         kadmin.local:  q
    
         bash-2.05b# klist -k
         Keytab name:  FILE:/etc/krb5/krb5.keytab
         KVNO Principal
         ---- ---------
         2 nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM
         2 nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM
         2 nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM
         2 nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM
  6. Set up the gssd daemon on the NFS Version 4 server.

    To enable NFS Version 4 using RPCSEC_GSS, you have to create the map file between the server’s keytab file and the NFS server principal, as shown below:

    Listing 7. Enabling NFS Version 4 using RPSEC-GSS
            bash-2.05b#  hostname
            adfsaix1.in.ibm.com
    
            bash-2.05b# nfshostkey -p nfs/adfsaix1.in.ibm.com -f /etc/krb5/krb5.keytab
            bash-2.05b#
            bash-2.05b# nfshostkey -l
            nfs/adfsaix1.in.ibm.com
            /etc/krb5/krb5.keytab
  7. Stop and restart the NFS daemons (gssd and nfsrgyd) so that all changes take effect and the daemons get started on subsequent machine reboots.
    Listing 8. Stopping and restarting the NFS daemons
            bash-2.05b#  hostname
            adfsaix1.in.ibm.com
            
            bash-2.05b# chnfs -s
            0513-004 The Subsystem or Group, gssd, is currently inoperative.
            
            bash-2.05b# chnfs -S -B 
            0513-059 The gssd Subsystem has been started. Subsystem PID is 389192.
            
            bash-2.05b# chnfs -v
            0513-044 The nfsrgyd Subsystem was requested to stop.
            
            bash-2.05b# chnfs -V 
            0513-059 The nfsrgyd Subsystem has been started. Subsystem PID is 413862.

    Enter lssrc -g nfs to make sure all of the NFS daemons are active.

  8. Export the directory from NFS server that can be accessed by Kerberos authenticated users or applications only.
    Listing 9. Exporting the directory
            bash-2.05b#  hostname
            adfsaix1.in.ibm.com
    
            bash-2.05b# exportfs -i -o vers=4,sec=krb5 /home/guest
            bash-2.05b# exportfs
            /home/guest -vers=4,sec=krb5
  9. Mount the exported directory locally to test that it is accessible with Kerberos authentication.

    Get the Kerberos credentials for the user and then mount the NFSv4 exported directory on ‘/mnt’.

    Listing 10. Mounting the exported directory locally
         bash-2.05b#  hostname
         adfsaix1.in.ibm.com
    
         bash-2.05b# kinit admin/admin
         Password for admin/admin@ADFSAIX1.IN.IBM.COM:
    
         bash-2.05b# mount -o vers=4,sec=krb5 adfsaix1.in.ibm.com:/home/guest/ /mnt
         bash-2.05b#
         bash-2.05b# cd /mnt
         bash-2.05b# ls -l
         total 0
         bash-2.05b# touch file.txt
         bash-2.05b# ls
         file.txt
    
         bash-2.05b# klist
         Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
         Default principal:  admin/admin@ADFSAIX1.IN.IBM.COM
    
         Valid starting     Expires            Service principal
         08/24/07 01:25:11  08/25/07 01:24:56  krbtgt/ADFSAIX1.IN.IBM.COM@ADFSAIX1.IN.IBM.COM
         08/24/07 01:25:21  08/25/07 01:24:56 
     nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM

    For further details on AIX NFS Version 4 configuration with Kerberos, please refer to the Securing NFS in AIX—An Introduction to NFS V4 in AIX 5L Version 5.3 Redbook (see Resources).

Setting up Microsoft Active Directory

For setting up Microsoft Active Directory on Microsoft Windows Server 2003, refer to the relevant Microsoft Windows documentation available on Microsoft Developer Network Web site (see Resources). For this scenario, we configured Active Directory on a machine with hostname windce20.in.ibm.com and named the Active Directory Domain MSKERBEROS.IN.IBM.COM, which we also refer it as Microsoft Kerberos Realm running on Microsoft Active Directory.

Inter-realm settings on IBM NAS KDC Server and Microsoft Active Directory

The following steps are required on both the KDC machines to set up an inter-realm between the two realms that have been configured so far.

  1. Add the krbtgt service principal to NAS KDC server.

    For a KDC of one realm to authenticate its Kerberos users in a different realm, it must share a key with the KDC in the other realm. So, you need to create krbtgt service principals for cross realms access. It is important that these principals all have the same passwords.

    Listing 11. Adding the krbtgt service principal to NAS KDC server
         bash-2.05b# hostname
         adfsaix1.in.ibm.com
    
         bash-2.05b# kadmin.local
         kadmin.local:   ank -pw f1lesystem krbtgt/MSKERBEROS.IN.IBM.COM@ADFSAIX1.IN.IBM.COM
         WARNING: no policy specified for krbtgt/MSKERBEROS.IN.IBM.COM@ADFSAIX1.IN.IBM.COM;
         defaulting to no policy. Note that policy may be overridden by
         ACL restrictions.
         Principal "krbtgt/MSKERBEROS.IN.IBM.COM@ADFSAIX1.IN.IBM.COM" created.
    
         kadmin.local:
         kadmin.local:  ank -pw f1lesystem krbtgt/ADFSAIX1.IN.IBM.COM@MSKERBEROS.IN.IBM.COM
         WARNING: no policy specified for krbtgt/ADFSAIX1.IN.IBM.COM@MSKERBEROS.IN.IBM.COM;
         defaulting to no policy. Note that policy may be overridden by
         ACL restrictions.
         Principal "krbtgt/ADFSAIX1.IN.IBM.COM@MSKERBEROS.IN.IBM.COM" created.
  2. Edit the NAS KDC server /etc/krb5/krb5.conf file, as follows:

    Change the Kerberos client file configuration to have entries of both the realms. In this case, we added MSKERBEROS.IN.IBM.COM stanza in the [realms] section and windce20.in.ibm.com = MSKERBEROS.IN.IBM.COM entry in the [domain_realm] section.

    Listing 12. Editing the NAS KDC server /etc/krb5/krb5.conf file
         bash-2.05b# hostname
         adfsaix1.in.ibm.com
    
         bash-2.05b#  cat /etc/krb5/krb5.conf
    
         [libdefaults]
         default_realm = ADFSAIX1.IN.IBM.COM
         default_keytab_name = FILE:/etc/krb5/krb5.keytab
         default_tkt_enctypes  = des3-cbc-sha1 arcfour-hmac aes256-cts des-cbc-md5 des-cbc-crc
         default_tgs_enctypes = des3-cbc-sha1 arcfour-hmac aes256-cts des-cbc-md5 des-cbc-crc
    
         [realms]
         ADFSAIX1.IN.IBM.COM = {
         kdc = adfsaix1.in.ibm.com:88
         admin_server = adfsaix1.in.ibm.com:749
         default_domain = in.ibm.com
         }
    
         MSKERBEROS.IN.IBM.COM  = {
         kdc = windce20.in.ibm.com:88
         admin_server = windce20.in.ibm.com:749
         default_domain = in.ibm.com
         }
    
         [domain_realm]
         adfsaix1.in.ibm.com = ADFSAIX1.IN.IBM.COM
         windce20.in.ibm.com = MSKERBEROS.IN.IBM.COM
    
         [logging]
         kdc = FILE:/var/krb5/log/krb5kdc.log
         admin_server = FILE:/var/krb5/log/kadmin.log
         default = FILE:/var/krb5/log/krb5lib.log

    If you have more than one AIX machine acting as NFS Version 4 server, make sure to add their hostname entry in the [domain_realm] section.

  3. Stop and restart the krb5 daemons so that all of the changes take effect.
    Listing 13. Stopping and restarting the krb5 daemons
            bash-2.05b# hostname
            adfsaix1.in.ibm.com
    
            bash-2.05b# stop.krb5
            Stopping /usr/krb5/sbin/krb5kdc...
            /usr/krb5/sbin/krb5kdc was stopped successfully.
            Stopping /usr/krb5/sbin/kadmind...
            /usr/krb5/sbin/kadmind was stopped successfully.
            The command completed successfully.
    
            bash-2.05b# start.krb5
            Starting krb5kdc...
            krb5kdc was started successfully.
            Starting kadmind...
            kadmind was started successfully.
            The command completed successfully.
  4. Verify the Active Directory configuration on the Windows machine.

    Figure 2 lists the existing setup of the Active Directory on windce20.in.ibm.com.

    Figure 2. Existing setup of Active Directory on windce20.in.ibm.com
    Existing setup of Active Directory on windce20.in.ibm.com
  5. Set up the configuration for the foreign Kerberos realm using the following command on Windows Active Directory machine.

    Figure 3 lists the output of adding KDC in Active Directory on windce20.in.ibm.com.

    Figure 3. KDC in Active Directory on windce20.in.ibm.com
    Output of adding KDC in Active Directory on windce20.in.ibm.com
  6. Create a trusted domain relationship with the AIX NAS realm on the Windows Active Directory.

    Log on to the Windows 2003 Server machine (windce20.in.ibm.com) hosting the Active Directory and do the following:

    • Start the Domain Tree Management tool. Click Programs, Administrative tools, and then Active Directory Domains and Trusts.
    • Right-click on the Properties of your domain, and then select the Trusts tab and press New Trust. Enter your AIX NAS realm that you want to add in the ADS trust list.
    • Select Realm trust as the trust type, Nontransitive as the trust transitivity, Two-way as the trust direction, and then in the Trust password, type the password you passed while creating krbtgt service principals above, for example, f1lesystem.
    • After this the entry is created for your trusted realm, verify the properties of it.

    Figure 4 lists the final output after adding the trust between the Active Directory realm and NAS realm on the Active Directory.

    Figure 4. Final output after adding the trust on the Active Directory
    Final output after adding the trust on the Active Directory.
  7. Confirm that you are able to get the TGT for the ADS principal (administrator) from the NAS server machine.
    Listing 14. Confirming that you are able to get the TGT for the ADS principal file
              bash-2.05b#  hostname
              adfsaix1.in.ibm.com
    
    
              bash-2.05b# kinit administrator@MSKERBEROS.IN.IBM.COM
              Password for administrator@MSKERBEROS.IN.IBM.COM:
    
              bash-2.05b# klist
              Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
              Default principal:  administrator@MSKERBEROS.IN.IBM.COM
    
              Valid starting     Expires            Service principal
              08/24/07 01:26:44  08/24/07 11:27:04 
    krbtgt/MSKERBEROS.IN.IBM.COM@MSKERBEROS.IN.IBM.COM
              Renew until 08/25/07 01:26:44

Setting up IBM NAS client and AIX NFS Version 4 client : Testing the scenario

  1. Install krb5 client and modcrypt filesets on the AIX 5.3 client machine.

    The command we used to install was:

    Listing 15. Installing krb5 client and modcrypt filesets
            bash-2.05b# hostname
            nfsaix02.in.ibm.com
     
            bash-2.05b# installp -aqXgYd . krb5.client modcrypt.base
  2. Configure the AIX NAS client, as follows:
    Listing 16. Configuring the AIX NAS client
            bash-2.05b# hostname
            nfsaix02.in.ibm.com
            
            bash-2.05b# export PATH=/usr/krb5/bin/:/usr/krb5/sbin/:$PATH
    		
            bash-2.05b# config.krb5 -C -r ADFSAIX1.IN.IBM.COM -d in.ibm.com -s
    adfsaix1.in.ibm.com -c adfsaix1.in.ibm.com
            Initializing configuration...
            Creating /etc/krb5/krb5_cfg_type...
            Creating /etc/krb5/krb5.conf...
            The command completed successfully.

    The AIX NAS client can also be configured using the AIX mkkrb5clnt command. For more information, please refer to the mkkrb5clnt man page.

    Then modify the client /etc/krb5/krb5.conf file, as previously mentioned for the NAS server.
  3. Set up the NFS domain name and add the NFS domain-to-realm mapping on the NFSv4 client machine:
    Listing 17. Setting up the NFS domain name and adding the NFS domain-to-realm mapping
              bash-2.05b# hostname
              nfsaix02.in.ibm.com
    
              bash-2.05b# chnfsdom 	in.ibm.com
    
              bash-2.05b# chnfsdom
              Current local domain: in.ibm.com
    
              bash-2.05b# chnfsrtd -a ADFSAIX1.IN.IBM.COM   in.ibm.com
              bash-2.05b# chnfsrtd -a MSKERBEROS.IN.IBM.COM in.ibm.com
    
              bash-2.05b# chnfsrtd
              adfsaix1.in.ibm.com		in.ibm.com
              mskerberos.in.ibm.com		in.ibm.com
  4. Stop and restart the NFS daemons (gssd and nfsrgyd) so that all changes take effect and the daemons get started on subsequent machine reboots.
    Listing 18. Stopping and restarting the NFS daemons
            bash-2.05b# hostname
            nfsaix02.in.ibm.com
            
            bash-2.05b# chnfs -s
            0513-004 The Subsystem or Group, gssd, is currently inoperative.
            
            bash-2.05b# chnfs -S -B
            0513-059 The gssd Subsystem has been started. Subsystem PID is 413932.
            
            bash-2.05b# chnfs -v
            0513-044 The nfsrgyd Subsystem was requested to stop.
            
            bash-2.05b# chnfs -V
            0513-059 The nfsrgyd Subsystem has been started. Subsystem PID is 258122.

    Make sure all of the NFS daemons are active now by running lssrc -g nfs. Also ensure that all the machines are in sync with the same time.

  5. Get the TGT for the user in Microsoft realm and use it to access the NFS exported data with krb5 security residing on IBM NAS realm.
    Listing 19. Getting the TGT for the user
              bash-2.05b# hostname
              nfsaix02.in.ibm.com
    
              bash-2.05b#  kinit administrator@MSKERBEROS.IN.IBM.COM
              Password for administrator@MSKERBEROS.IN.IBM.COM:
    
              bash-2.05b# mount -o vers=4,sec=krb5 adfsaix1.in.ibm.com:/home/guest/ /mnt
              bash-2.05b# cd /mnt
              bash-2.05b# touch new.txt
              bash-2.05b# ls
              file.txt  new.txt
    
              bash-2.05b# klist
              Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
              Default principal:  administrator@MSKERBEROS.IN.IBM.COM
    
              Valid starting     Expires            Service principal
              08/24/07 01:26:44  08/24/07 11:27:04 
    krbtgt/MSKERBEROS.IN.IBM.COM@MSKERBEROS.IN.IBM.COM
              Renew until 08/25/07 01:26:44
              08/24/07 01:26:44  08/24/07 11:27:04 
    krbtgt/ADFSAIX1.IN.IBM.COM@MSKERBEROS.IN.IBM.COM
              Renew until 08/25/07 01:26:44
              08/24/07 01:27:25  08/24/07 11:27:04 
    nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM
              Renew until 08/25/07 01:26:44

Conclusion

In this article, you have seen how you can configure Kerberos (IBM NAS and Microsoft Active Directory) to facilitate the use of AIX NFS Version 4 across organizational boundaries to work in a heterogeneous environment.

Resources

Learn

Get products and technologies

Discuss

Comments

developerWorks: Sign in

Required fields are indicated with an asterisk (*).


Need an IBM ID?
Forgot your IBM ID?


Forgot your password?
Change your password

By clicking Submit, you agree to the developerWorks terms of use.

 


The first time you sign into developerWorks, a profile is created for you. Information in your profile (your name, country/region, and company name) is displayed to the public and will accompany any content you post, unless you opt to hide your company name. You may update your IBM account at any time.

All information submitted is secure.

Choose your display name



The first time you sign in to developerWorks, a profile is created for you, so you need to choose a display name. Your display name accompanies the content you post on developerWorks.

Please choose a display name between 3-31 characters. Your display name must be unique in the developerWorks community and should not be your email address for privacy reasons.

Required fields are indicated with an asterisk (*).

(Must be between 3 – 31 characters.)

By clicking Submit, you agree to the developerWorks terms of use.

 


All information submitted is secure.

Dig deeper into AIX and Unix on developerWorks


static.content.url=http://www.ibm.com/developerworks/js/artrating/
SITE_ID=1
Zone=AIX and UNIX
ArticleID=280780
ArticleTitle=AIX NFS Version 4 configuration over Kerberos inter-realm setup
publish-date=01082008