文档建议反馈控制台
首页
学习
活动
专区
圈层
工具
MCP广场
文章/答案/技术大牛
发布
社区首页 >问答首页 >NFS4 + Kerberos: BAD_ENCRYPTION_TYPE，GSS:加密类型不允许，坚持“下行调用”

问NFS4 + Kerberos: BAD_ENCRYPTION_TYPE，GSS:加密类型不允许，坚持“下行调用”
EN

Server Fault用户
提问于 2013-04-05 10:34:35
回答 1查看 3.5K关注 0票数 0

我正试图让NFS4 + Kerberos在Debian挤压上工作。

我有3台测试机器: nfsserver，nfsclient，nfskerberos。

我得到的是：

代码语言：javascript
复制
root@nfsclient:~# mount -v -t nfs4  -o sec=krb5 nfsserver.mydomain.com:/export /import 
mount.nfs4: timeout set for Fri Apr  5 10:15:33 2013
mount.nfs4: trying text-based options 'sec=krb5,addr=10.10.16.207,clientaddr=10.10.16.208'
mount.nfs4: mount(2): Permission denied
mount.nfs4: access denied by server while mounting nfsserver.mydomain.com:/export

我认为问题在于nfsclient<->nfskerberos的交流。在嗅探这些系统之间的网络流量后，我看到以下消息：

代码语言：javascript
复制
error_code: KRB5KDC_ERR_ETYPE_NOSUPP (14)
[...]
e-text: BAD_ENCRYPTION_TYPE

只有nfsclient与nfskerberos沟通.nfskerberos没有来自nfsserver的流量

但是，nfsclient上的kinit -k工作正常，不过：

代码语言：javascript
复制
root@nfsclient:~# kinit -k nfs/nfsclient.mydomain.com
root@nfsclient:~# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: nfs/nfsclient.mydomain.com@MYDOMAIN.COM

Valid starting     Expires            Service principal
04/05/13 11:44:55  04/05/13 21:44:55  krbtgt/MYDOMAIN.COM@MYDOMAIN.COM
renew until 04/06/13 11:44:55

但是kinit作为REQ和挂载请求执行TGS-REQ。

我尝试过多种加密类型，例如：

  • des-cbc-crc:正常
  • 美学256-cts-hmac-SHA1-96:正常(本品适用于kinit)
  • Des3-HMAC-SHA1:正常
  • ..。

在nfskerberos上，在kdc配置中，我有：

代码语言：javascript
复制
[kdcdefaults]
    kdc_ports = 750,88

[realms]
    MYDOMAIN.COM = {
        database_name = /var/lib/krb5kdc/principal
        admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
        acl_file = /etc/krb5kdc/kadm5.acl
        key_stash_file = /etc/krb5kdc/stash
        kdc_ports = 750,88
        max_life = 10h 0m 0s
        max_renewable_life = 7d 0h 0m 0s
        master_key_type = des3-hmac-sha1
        supported_enctypes = aes256-cts:normal arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3
        default_principal_flags = +preauth
    }

nfsclient和nfskerberos之间的对话：

代码语言：javascript
复制
No.     Time        Source                Destination           Protocol Length Info
      7 11.128679   10.10.16.208          10.10.16.209          KRB5     808    TGS-REQ

[ cut lower level protocols data ]

Kerberos TGS-REQ
    Pvno: 5
    MSG Type: TGS-REQ (12)
    padata: PA-TGS-REQ
        Type: PA-TGS-REQ (1)
            Value: 6e82025630820252a003020105a10302010ea20703050000... AP-REQ
                Pvno: 5
                MSG Type: AP-REQ (14)
                Padding: 0
                APOptions: 00000000
                    0... .... .... .... .... .... .... .... = reserved: RESERVED bit off
                    .0.. .... .... .... .... .... .... .... = Use Session Key: Do NOT use the session key to encrypt the ticket
                    ..0. .... .... .... .... .... .... .... = Mutual required: Mutual authentication is NOT required
                Ticket
                    Tkt-vno: 5
                    Realm: MYDOMAIN.COM
                    Server Name (Service and Instance): krbtgt/MYDOMAIN.COM
                        Name-type: Service and Instance (2)
                        Name: krbtgt
                        Name: MYDOMAIN.COM
                    enc-part aes256-cts-hmac-sha1-96
                        Encryption type: aes256-cts-hmac-sha1-96 (18)
                        Kvno: 1
                        enc-part: c03dbd56915263874441e07531f689fa16ed7593a8118741...
                Authenticator aes256-cts-hmac-sha1-96
                    Encryption type: aes256-cts-hmac-sha1-96 (18)
                    Authenticator data: bae42b08eb935796e3dd31d9d34f5a4cc419b6594be7a8ed...
    KDC_REQ_BODY
        Padding: 0
        KDCOptions: 50810000 (Forwardable, Proxiable, Renewable, Canonicalize)
            .1.. .... .... .... .... .... .... .... = Forwardable: FORWARDABLE tickets are allowed/requested
            ..0. .... .... .... .... .... .... .... = Forwarded: This is NOT a forwarded ticket
            ...1 .... .... .... .... .... .... .... = Proxiable: PROXIABLE tickets are allowed/requested
            .... 0... .... .... .... .... .... .... = Proxy: This ticket has NOT been proxied
            .... .0.. .... .... .... .... .... .... = Allow Postdate: We do NOT allow the ticket to be postdated
            .... ..0. .... .... .... .... .... .... = Postdated: This ticket is NOT postdated
            .... .... 1... .... .... .... .... .... = Renewable: This ticket is RENEWABLE
            .... .... ...0 .... .... .... .... .... = Opt HW Auth: False
            .... .... .... ..0. .... .... .... .... = Constrained Delegation: This is a normal request (no constrained delegation)
            .... .... .... ...1 .... .... .... .... = Canonicalize: This is a request for a CANONICALIZED ticket
            .... .... .... .... .... .... ..0. .... = Disable Transited Check: Transited checking is NOT disabled
            .... .... .... .... .... .... ...0 .... = Renewable OK: We do NOT accept renewed tickets
            .... .... .... .... .... .... .... 0... = Enc-Tkt-in-Skey: Do NOT encrypt the tkt inside the skey
            .... .... .... .... .... .... .... ..0. = Renew: This is NOT a request to renew a ticket
            .... .... .... .... .... .... .... ...0 = Validate: This is NOT a request to validate a postdated ticket
        Realm: MYDOMAIN.COM
        Server Name (Service and Host): nfs/nfsserver.mydomain.com
            Name-type: Service and Host (3)
            Name: nfs
            Name: nfsserver.mydomain.com
        till: 2013-04-05 17:58:28 (UTC)
        Nonce: 1365155889
        Encryption Types: aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 rc4-hmac des-cbc-crc des-cbc-md5 des-cbc-md4
            Encryption type: aes256-cts-hmac-sha1-96 (18)
            Encryption type: aes128-cts-hmac-sha1-96 (17)
            Encryption type: des3-cbc-sha1 (16)
            Encryption type: rc4-hmac (23)
            Encryption type: des-cbc-crc (1)
            Encryption type: des-cbc-md5 (3)
            Encryption type: des-cbc-md4 (2)

No.     Time        Source                Destination           Protocol Length Info
      8 11.130891   10.10.16.209          10.10.16.208          KRB5     244    KRB Error: KRB5KDC_ERR_ETYPE_NOSUPP

[ cut lower level protocols data ]

Kerberos KRB-ERROR
    Pvno: 5
    MSG Type: KRB-ERROR (30)
    ctime: 2013-04-05 09:58:09 (UTC)
    stime: 2013-04-05 09:58:09 (UTC)
    susec: 588499
    error_code: KRB5KDC_ERR_ETYPE_NOSUPP (14)
    Client Realm: MYDOMAIN.COM
    Client Name (Principal): nfs/nfsclient.mydomain.com
        Name-type: Principal (1)
        Name: nfs
        Name: nfsclient.mydomain.com
    Realm: MYDOMAIN.COM
    Server Name (Service and Host): nfs/nfsserver.mydomain.com
        Name-type: Service and Host (3)
        Name: nfs
        Name: nfsserver.mydomain.com
    e-text: BAD_ENCRYPTION_TYPE
nfs
kerberos
EN

回答 1

Server Fault用户

回答已采纳

发布于 2013-04-08 13:49:23

如果有人走同样的路：

通过在/etc/krb5.conf中添加allow_weak_crypto = true来解决原来的问题。

接下来我面临着另一个问题，那就是：

代码语言：javascript
复制
Apr 5 16:31:46 nfsserver rpc.svcgssd[2047]: ERROR: GSS-API: error in handle_nullreq: gss_accept_sec_context(): Unspecified GSS failure. Minor code may provide more information - Encryption type not permitted

以前有人已经描述过了：http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637660，但是我没有找到任何解决方案，所以我决定尝试使用Debian作为nfsserver。

Wheeze似乎在GSS身份验证方面做了一些进一步的工作，但是在nfsserver端使用类似这样的内容来安装请求：

代码语言：javascript
复制
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: leaving poll
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: handling null request
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: svcgssd_limit_krb5_enctypes: Calling gss_set_allowable_enctypes with 7 enctypes from the kernel
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: sname = nfs/nfsclient.mydomain.com@MYDOMAIN.COM
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: DEBUG: serialize_krb5_ctx: lucid version!
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: prepare_krb5_rfc1964_buffer: serializing keys with enctype 4 and length 8
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: doing downcall
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: mech: krb5, hndl len: 4, ctx len 85, timeout: 1365455915 (32884 from now), clnt: nfs@nfsclient.mydomain.com, uid: -1, gid: -1, num aux grps: 0:
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: sending null reply
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: writing message: \x \x6082024606092a864886f71201020201006e82023530820231a003020105a10302010ea20703050020000000a38201596182015530820151a003020105a10d1b0b504152502e474f562e504ca2283026a003020103a11f301d1b036e66731b166e6673736572766572372e706172702e676f762e706ca382010f3082010ba003020112a103020102a281fe0481fbe088a06336ffcc607f9efbafa64f0504ea442ac6a5eb234a0e3c1a332b2648702e8eb0827c0b921fffaa232f093eca19df57ac14fb2f4cf1d7f86ae10c021c86aebd0f1a66916224445b872f05ff741b7978d5aeec8d446527f7aeca27858ce588914c046e321ff37a6db5d1c1b20871657bfafd180f0d1c591efef73ed31a09a04966e869888718da74ac226642c46b78a05f1621f4b1c4fe0dc59f6fa75a6a7feee6e81ee0eb9e4c6d01223b2725fecd7699efc4dc362df32383af681da948431fd3b39c8907a938a3729cff7c89407033341ba3c1f77d96accfe7c66446e1f76a936faa3c44a021a14a96658f89071ed66d4d9a6c6953698000a481be3081bba003020101a281b30481b057d186fa3e7ec53c26efe3535d3d447732da00abd0683e66fb93f457ec19a86fdd5050e2bb054dc721c1235d3156f41465e5a66c23ba5bb9201c4d38edbe92b7265b60c8f49329ffc398af58c0af2228aa1cfc2cc4968b2913abd18f0189996ebe9c57d649925bebc3efe1c53b2c86a5d51a86f7f58bd9d2d80271973190f2e258418581d5f5e1687ea0997ef7350e90061335be1e15b978b03fea21ba697d90f3c88397375cff94a9342306d642dc2a 1365423091 0 0 \x01000000 \x607006092a864886f71201020202006f61305fa003020105a10302010fa2533051a003020101a24a044882577e0441254f6c05add73796908deb02b7f61d90d7ed5bd54f67bb72e7ea2f8898ae1a6eb6e8fe631753b01bc9340dc4cdabf1b1985c449d28b4e9568aa85259f2cc591628a696 
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: finished handling null request
Apr  8 14:10:31 nfsserver7 rpc.svcgssd[3924]: entering poll

还有一些人已经处理过这个问题：http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=682709，但是他们建议的唯一可行的解决方案是安装nfs的旧版本(公共的\内核-服务器)。

这对我也有用。

我学到的是:建立NFS + Kerberos不是喜悦。;-)

票数 2
EN
页面原文内容由Server Fault提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：

https://serverfault.com/questions/496418

复制
相关文章

相似问题

领券

腾讯云开发者

扫码关注腾讯云开发者

扫码关注腾讯云开发者

领取腾讯云代金券

热门产品

热门推荐

更多推荐

Copyright © 2013 - 2026 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 粤公网安备44030502008569号

腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号

问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档