Sds-hd kerberos

From bwHPC Wiki
Revision as of 20:34, 16 September 2020 by S Siebler (talk | contribs) (kerberos environment for SDS@hd)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

kerberos environment for SDS@hd

  • For Kerberos authentication to work, a correctly synchronized system time must be set on each nfs client (e.g. via ntpdate or chrony)

The following parameters of kerberos tickets are set on server side:

  • max. Lifetime of a Serviceticket: 10 hours
  • max. Lifetime of a Userticket: 24 hours
  • max. Renewaltime for Usertickets: 10 days

The properties (e.g. lifetimes, encryption, ...) of the kerberos tickets can be changed on client site with different kinit parameters (see manpages of kinit) or via /etc/krb5.conf.

First you have to install kerberos packages in your system to provide a working kerberos environment. The exact names of the packages depending on you linux distribution (see examples below).

Example RedHat/CentOS

yum install krb5-workstation

Example debian/ubuntu

apt install krb5-user

On ubuntu server: nfs-kernel-server

After installing the packages you have to use the following kerberos parameters for connecting to SDS@hd:

  • KDC =

So your kerberos configuration file (/etc/krb5.conf) should contain the following entries:


          kdc =
          admin_server =

The keytab file of the machine, which you get from the SDS@hd Team, has to be stored as /etc/krb5.keytab in the system.

Because of caching issue with the kerberos ticket cache, you have to disable gssproxy service:

systemctl stop gssproxy.service
systemctl mask gssproxy.service