Setting up Kerberos authentication for NFS clients
Kerberos provides a secure way of authenticating NFS clients. In this configuration, the Access Appliance server behaves as a Kerberos client. The Kerberos KDC (Key Distribution Center) server must already be set up and running outside of Access Appliance. For NFS version 3, when a Access Appliance share is exported with the krb5 security option, the NFS clients have to mount the Access Appliance share with the krb5 mount option. Otherwise the mount fails with an authentication error. For NFS version 4, the NFS clients automatically find the security type and mount the Access Appliance share with the same mount option.
Note:
When CIFS security is configured with ads, Kerberos for NFS cannot be configured. When NFS is configured for Kerberos authentication, CIFS security cannot be configured with ads.
To configure Access Appliance for authenticating NFS clients using Kerberos, perform the tasks in the order that is listed in Table: Tasks for configuring Access Appliance for authenticating NFS clients using Kerberos.
Table: Tasks for configuring Access Appliance for authenticating NFS clients using Kerberos
Task | Where to find more information |
|---|---|
Add and configure Access Appliance to the Kerberos realm | See Adding and configuring Access Appliance to the Kerberos realm. |
Configure the NFS server for ID mapping | See Configuring Access Appliance for ID mapping for NFS version 4. |
Configure the NFS client for ID mapping | See Configuring the NFS client for ID mapping for NFS version 4. |
Exporting an NFS share for Kerberos authentication | |
Mount the NFS share from the NFS client | See Mounting an NFS share with Kerberos security from the NFS client. |