I'm trying to set up a kerberized NFS share from an HA cluster. I've successfully set up a krb-aware NFS share from a single server, I'm using a mostly identical configuration on the cluster.
Exports file from working single server:
/nfs *(rw,sec=krb5:krb5i:krb5p)
Cluster resource configuration:
# pcs resource show nfs-export1
Resource: nfs-export1 (class=ocf provider=heartbeat type=exportfs)
Attributes: clientspec=10.1.0.0/255.255.255.0 directory=/nfsshare/exports/export1 fsid=1 options=rw,sec=krb5:krb5i:krb5p,sync,no_root_squash
Operations: monitor interval=10 timeout=20 (nfs-export1-monitor-interval-10)
start interval=0s timeout=40 (nfs-export1-start-interval-0s)
stop interval=0s timeout=120 (nfs-export1-stop-interval-0s)
Client showmount to working single server:
# showmount -e ceserv
Export list for ceserv:
/nfs *
Client showmount to floating cluster name:
# showmount -e hafloat
Export list for hafloat:
/nfsshare/exports/export1 10.1.0.0/255.255.255.0
/nfsshare/exports 10.1.0.0/255.255.255.0
Contents of client /etc/fstab:
ceserv:/nfs /mnt/nfs nfs4 sec=krb5i,rw,proto=tcp,port=2049
hafloat.ncphotography.lan:export1 /nfsmount nfs4 sec=krb5i,rw,proto=tcp,port=2049
Results of mount -av command:
# mount -av
mount.nfs4: timeout set for Mon Dec 4 20:57:14 2017
mount.nfs4: trying text-based options 'sec=krb5i,proto=tcp,port=2049,vers=4.1,addr=10.1.0.24,clientaddr=10.1.0.23'
/mnt/nfs : successfully mounted
mount.nfs4: timeout set for Mon Dec 4 20:57:14 2017
mount.nfs4: trying text-based options 'sec=krb5i,proto=tcp,port=2049,vers=4.1,addr=10.1.0.29,clientaddr=10.1.0.23'
mount.nfs4: mount(2): Operation not permitted
mount.nfs4: Operation not permitted
All firewalls have been disabled. All names resolve correctly to IP addresses within the 10.1.0.0/24 network, and all IP addresses reverse-resolve to the correct hostname.
