| Message ID | 20221207202841.525930-1-joachim.falk@gmx.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | systemd: Don't degrade system state for nfs-clients when krb5 keytab present but not containing the nfs/<FQDN> principal. | expand |
On 12/7/22 3:28 PM, Joachim Falk wrote: > The nfs-client.target requires the auth-rpcgss-module.service, which in > turn requires the rpc-svcgssd.service. However, the rpc.svcgssd daemon > is unnecessary for an NFS client, even when using Kerberos security. > Moreover, starting this daemon with its default configuration will fail > when no nfs/<host>@REALM principal is in the Kerberos keytab. Thus, > resulting in a degraded system state for NFS client configurations > without nfs/<host>@REALM principal in the Kerberos keytab. However, this > is a perfectly valid NFS client configuration as the nfs/<host>@REALM > principal is not required for mounting NFS file systems. This is even > the case when Kerberos security is enabled for the mount! > > Installing the gssproxy package hides this problem as this disables the > rpc-svcgssd.service. > > Link: http://bugs.debian.org/985002 > Link: https://salsa.debian.org/kernel-team/nfs-utils/-/merge_requests/23 > > Signed-off-by: Joachim Falk <joachim.falk@gmx.de> Committed... (tag: nfs-utils-2-6-3-rc6) steved > --- > systemd/auth-rpcgss-module.service | 2 +- > systemd/nfs-server.service | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/systemd/auth-rpcgss-module.service b/systemd/auth-rpcgss-module.service > index 25c9de80..4a69a7b7 100644 > --- a/systemd/auth-rpcgss-module.service > +++ b/systemd/auth-rpcgss-module.service > @@ -8,7 +8,7 @@ > Description=Kernel Module supporting RPCSEC_GSS > DefaultDependencies=no > Before=gssproxy.service rpc-svcgssd.service rpc-gssd.service > -Wants=gssproxy.service rpc-svcgssd.service rpc-gssd.service > +Wants=gssproxy.service rpc-gssd.service > ConditionPathExists=/etc/krb5.keytab > ConditionVirtualization=!container > > diff --git a/systemd/nfs-server.service b/systemd/nfs-server.service > index b432f910..2cdd7868 100644 > --- a/systemd/nfs-server.service > +++ b/systemd/nfs-server.service > @@ -15,7 +15,7 @@ After=nfsdcld.service > Before=rpc-statd-notify.service > > # GSS services dependencies and ordering > -Wants=auth-rpcgss-module.service > +Wants=auth-rpcgss-module.service rpc-svcgssd.service > After=rpc-gssd.service gssproxy.service rpc-svcgssd.service > > [Service] > -- > 2.35.1 >
diff --git a/systemd/auth-rpcgss-module.service b/systemd/auth-rpcgss-module.service index 25c9de80..4a69a7b7 100644 --- a/systemd/auth-rpcgss-module.service +++ b/systemd/auth-rpcgss-module.service @@ -8,7 +8,7 @@ Description=Kernel Module supporting RPCSEC_GSS DefaultDependencies=no Before=gssproxy.service rpc-svcgssd.service rpc-gssd.service -Wants=gssproxy.service rpc-svcgssd.service rpc-gssd.service +Wants=gssproxy.service rpc-gssd.service ConditionPathExists=/etc/krb5.keytab ConditionVirtualization=!container diff --git a/systemd/nfs-server.service b/systemd/nfs-server.service index b432f910..2cdd7868 100644 --- a/systemd/nfs-server.service +++ b/systemd/nfs-server.service @@ -15,7 +15,7 @@ After=nfsdcld.service Before=rpc-statd-notify.service # GSS services dependencies and ordering -Wants=auth-rpcgss-module.service +Wants=auth-rpcgss-module.service rpc-svcgssd.service After=rpc-gssd.service gssproxy.service rpc-svcgssd.service [Service]
The nfs-client.target requires the auth-rpcgss-module.service, which in turn requires the rpc-svcgssd.service. However, the rpc.svcgssd daemon is unnecessary for an NFS client, even when using Kerberos security. Moreover, starting this daemon with its default configuration will fail when no nfs/<host>@REALM principal is in the Kerberos keytab. Thus, resulting in a degraded system state for NFS client configurations without nfs/<host>@REALM principal in the Kerberos keytab. However, this is a perfectly valid NFS client configuration as the nfs/<host>@REALM principal is not required for mounting NFS file systems. This is even the case when Kerberos security is enabled for the mount! Installing the gssproxy package hides this problem as this disables the rpc-svcgssd.service. Link: http://bugs.debian.org/985002 Link: https://salsa.debian.org/kernel-team/nfs-utils/-/merge_requests/23 Signed-off-by: Joachim Falk <joachim.falk@gmx.de> --- systemd/auth-rpcgss-module.service | 2 +- systemd/nfs-server.service | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.35.1