NFS/Kerberos: Difference between revisions
(Removed old ZFS-related stuff (still preserved in history) - I'm not sure about the NFS/KRB thing, so I've left that for now.) |
(→NFS) |
||
| (13 intermediate revisions by 6 users not shown) | |||
| Line 1: | Line 1: | ||
Our user-data is stored in /users on [[Machine_List# |
Our user-data is stored in /users on [[Machine_List#psilodump|psilodump]] on an ISCSI volume exported to [[Machine_List#aspartame|aspartame]], which exports /users/ via NFS. Plans to add a layer of LVM abstraction so as to support regular snapshot backups of /users/ are currently in-place, but not yet fully implemented. All of our systems NFS mount /users, and most of them do so using [[Kerberos]] for authentication. |
||
We have also explored additional methods for replicating user-data, including AFS, Coda, and DRBD, but have found all to be unusable or problematic. |
We have also explored additional methods for replicating user-data, including AFS, Coda, and DRBD, but have found all to be unusable or problematic. |
||
| Line 9: | Line 9: | ||
On November 8, 2007, we experienced a major NFS failure. An analysis of the logs indicated that the fault was likely caused by NFSv4-specific code. As a result, we have returned to mounting with NFSv3. |
On November 8, 2007, we experienced a major NFS failure. An analysis of the logs indicated that the fault was likely caused by NFSv4-specific code. As a result, we have returned to mounting with NFSv3. |
||
In November 2015, we made another attempt at mounting with NFSv4 in the office. This was a huge time suck and failed sporadically. As a result, we have returned to mounting with NFSv3. NFSv4 ACLs/mapping seem to be the culprit. NFSv4, '''just not ready'''. |
|||
| ⚫ | |||
== Troubleshooting == |
|||
| ⚫ | |||
* If NFS refuses to mount, with a message similar to "Incorrect mount option was specified", ensure that the "nfs-common" service is running. This is required for Kerberos authentication with NFS. |
|||
The NFSv4 domain is auto-detected by default, although to be safe, you can explicitly set it in /etc/default/nfs: |
|||
NFSMAPID_DOMAIN=csclub.uwaterloo.ca |
|||
| ⚫ | |||
=== Initial setup === |
|||
This documents some important steps that needed to be done once. |
|||
You need to create an NFS Kerberos principal on caffeine: |
|||
sudo kadmin.local |
|||
addprinc -randkey zfs/ginseng.csclub.uwaterloo.ca |
|||
ktadd -e des-cbc-crc:normal -k /tmp/ginseng.nfs.keytab |
|||
You then need to merge that keytab (using ktutil) into /etc/krb5/krb5.keytab on ginseng. |
|||
| ⚫ | |||
== NFS (client-side) == |
|||
[[Category:Services]] |
|||
In order to support NFSv4 ACL's with getfacl/setfacl, you should apply the [http://www.citi.umich.edu/projects/nfsv4/linux/ NFSv4 ACL patch]. You can also compile the [http://www.citi.umich.edu/projects/nfsv4/linux/ nfs4_getfacl/nfs4_setfacl utils]. |
|||
[[Category:Software]] |
|||
Latest revision as of 01:20, 4 December 2015
Our user-data is stored in /users on psilodump on an ISCSI volume exported to aspartame, which exports /users/ via NFS. Plans to add a layer of LVM abstraction so as to support regular snapshot backups of /users/ are currently in-place, but not yet fully implemented. All of our systems NFS mount /users, and most of them do so using Kerberos for authentication.
We have also explored additional methods for replicating user-data, including AFS, Coda, and DRBD, but have found all to be unusable or problematic.
NFS
NFSv3 has been in long standing use by the CSC as well as almost everyone else on the planet. NFSv4 mounts of /users are currently in the works to CSCF. Unfortunately NFS has a number of problems. Clients become desperately unhappy when disconnected from the NFS server. Also previous to NFSv4 there was no way to client side cache, resulting in poor performance with large files.
On November 8, 2007, we experienced a major NFS failure. An analysis of the logs indicated that the fault was likely caused by NFSv4-specific code. As a result, we have returned to mounting with NFSv3.
In November 2015, we made another attempt at mounting with NFSv4 in the office. This was a huge time suck and failed sporadically. As a result, we have returned to mounting with NFSv3. NFSv4 ACLs/mapping seem to be the culprit. NFSv4, just not ready.
Troubleshooting
- If NFS refuses to mount, with a message similar to "Incorrect mount option was specified", ensure that the "nfs-common" service is running. This is required for Kerberos authentication with NFS.
ZFS
On March 15, 2008, we transitioned to ZFS. This move has since been reversed; details are preserved in a previous revision of this page