Apache userdir over Kerberized NFSv4 mount : Forbidden access

I have set up a practical room dedicated to web development learning. Users accounts are managed by a Samba 4 AD and users files are stored in a central NFS server with exports securised by Kerberos.

All work fine :

  • Users can be authenticated by Kerberos (and receive a ticket at login)
  • Homes are mounted fine with NFS4 (sec=krb5)
  • Rights are correctly applied to all domain users

But, I need to install on each client a localhost-only apache server (with php and other stuff) with userdir activated.

I've crawled the internet but it seems that very few people are in the same configuration as me.

I've tried all I found like creating an spn and an apache dedicated keytab :

# samba-tool spn add HTTP/client1.domain client1$ # samba-tool domain exportkeytab httpclient1.keytab --principal=HTTP/client1.domain 

and exporting this generated keytab in /etc/apache2 on client1 but if I try to do a kinit on this keytab : # kinit -k -t /etc/apache2/client1http.keytab HTTP/client1.domain kinit: Client "HTTP/[email protected]" not found in Kerberos database while getting initial credentials

keytab seems to be correct :

# klist -kt /etc/apache2/client1http.keytab KVBO Timestamp           Principal ---- ------------------- ----------------------------    4 29/07/2016 16:12:38 HTTP/[email protected]    4 29/07/2016 16:12:38 HTTP/[email protected]    4 29/07/2016 16:12:38 HTTP/[email protected] 

I don't know how to made this working... Must I create a domain user to replace local www-data user on each client ?

Just for informational purpose : Server side : Ubuntu server 14.04 (upgrade to 16.04 planned... but later) with samba 4.2.3 (compiled) Client side : XUbuntu 16.04 with samba 4.3.9 (from repos)

All help would be appreciated !!

Best regards, Bruno.

Replay

Category: kerberos Time: 2016-07-29 Views: 0

Related post

iOS development

Android development

Python development

JAVA development

Development language

PHP development

Ruby development

search

Front-end development

Database

development tools

Open Platform

Javascript development

.NET development

cloud computing

server

Copyright (C) avrocks.com, All Rights Reserved.

processed in 0.205 (s). 12 q(s)