Difference between revisions of "Sds-hd nfs"
(→AutoFS Setup) |
S Richling (talk | contribs) (Redirected page to SDS@hd) (Tag: New redirect) |
||
| Line 1: | Line 1: | ||
| + | #REDIRECT [[SDS@hd]] |
||
| − | = <b> Prerequisites </b> = |
||
| − | |||
| − | * '''Attention:''' To access data served by SDS@hd, You need a '''''Service Password'''''. See details [[Sds-hd_user_access]]. |
||
| − | |||
| − | * Additionally the access to SDS@hd is currently only available inside the [https://www.belwue.de/netz/netz0.html belwue-Network]. This means you have to use the VPN Service of your HomeOrganization, if you want to access SDS@hd from outside the bwHPC-Clusters (e.g. via [https://www.eduroam.org/where/ eduroam] or from your personal Laptop) |
||
| − | |||
| − | * The access via nfs protocol is machine-based, which means '''new nfs-Clients have to be registered''' on SDS@hd. During this registration each machine gets a keytab file, which allows mounting SDS@hd. |
||
| − | |||
| − | * Currently you have to [mailto:sds-hd-support@urz.uni-heidelberg.de?subject=SDS@hd%20nfs-Client%20Registration send an email] for Clientregistration to SDS@hd Team with the following information: |
||
| − | ** hostname of the new nfs-Client |
||
| − | ** IP address |
||
| − | ** short description |
||
| − | ** location |
||
| − | ** acronym of the Speichervorhaben which should be available on this machine |
||
| − | |||
| − | = <b> Using NFSv4 for UNIX client </b> = |
||
| − | |||
| − | The authentication for data access via NFSv4 is performed using Kerberostickets. This requires a functioning Kerberos environment on the client! |
||
| − | |||
| − | {{:Sds-hd_kerberos}} |
||
| − | |||
| − | After configuring kerberos, you have to install nfs packages in your system, and enable kerberized NFSv4. The exact names of the packages depending on you linux distribution (see examples below). |
||
| − | |||
| − | ''Example RedHat/CentOS'' |
||
| − | <pre> |
||
| − | > yum install nfs-utils nfs4-acl-tools |
||
| − | |||
| − | /etc/sysconfig/nfs: |
||
| − | NEED_IDMAPD=yes |
||
| − | NEED_GSSD=yes |
||
| − | </pre> |
||
| − | |||
| − | ''Example debian/ubuntu'' |
||
| − | <pre> |
||
| − | > apt install nfs-common nfs4-acl-tools nfs-server |
||
| − | |||
| − | /etc/default/nfs-common: |
||
| − | NEED_IDMAPD=yes |
||
| − | NEED_GSSD=yes |
||
| − | </pre> |
||
| − | On ubuntu server: nfs-kernel-server |
||
| − | |||
| − | {{:Sds-hd_idmapping}} |
||
| − | |||
| − | To enable the ID-Mapping for NFSv4 mounts change the file ''/etc/idmapd.conf'' with the following lines: |
||
| − | <pre> |
||
| − | in /etc/idmapd.conf: |
||
| − | [General] |
||
| − | Domain = urz.uni-heidelberg.de |
||
| − | Local-Realms = BWSERVICES.UNI-HEIDELBERG.DE |
||
| − | </pre> |
||
| − | |||
| − | == mount a nfs share == |
||
| − | The usual restrictions for mounting drives under Linux apply. Usually this can only be done by the superuser "root". For detailed information, please contact the system administrator of your system. |
||
| − | |||
| − | After successfull configuration (s. 2.1) you can mount your SDS@hd share with the following commands: |
||
| − | <pre> |
||
| − | > mkdir <mountpoint> |
||
| − | > mount -t nfs4 -o sec=krb5,vers=4.0 lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint> |
||
| − | </pre> |
||
| − | |||
| − | To enable the mounting after a restart, you have to add the following line to the file "/etc/fstab" |
||
| − | <pre> |
||
| − | lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint> nfs4 sec=krb5,vers=4.0 0 0 |
||
| − | </pre> |
||
| − | |||
| − | === AutoFS Setup === |
||
| − | |||
| − | Instead of the fstab-entry you can also use the automounter "autofs". |
||
| − | |||
| − | * RedHat/CentOS: |
||
| − | <pre> |
||
| − | $ yum install autofs |
||
| − | $ systemctl enable autofs |
||
| − | $ systemctl start autofs |
||
| − | </pre> |
||
| − | |||
| − | * debian/ubuntu: |
||
| − | <pre> |
||
| − | $ apt install autofs |
||
| − | $ systemctl enable autofs |
||
| − | $ systemctl start autofs |
||
| − | </pre> |
||
| − | |||
| − | Afterwards you configure the SDS@hd Speichervorhaben in a new map file: |
||
| − | <pre> |
||
| − | $ cat /etc/auto.sds-hd |
||
| − | sds-hd -fstype=nfs4,rw,sec=krb5,vers=4.0,nosuid,nodev lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02 |
||
| − | .... |
||
| − | </pre> |
||
| − | |||
| − | You have to include the new map into the auto.master file, e.g.: |
||
| − | <pre> |
||
| − | $ cat /etc/auto.master |
||
| − | [...] |
||
| − | /mnt /etc/auto.sds-hd |
||
| − | [...] |
||
| − | </pre> |
||
| − | |||
| − | To display all available SDS@hd shares on this machine to the users, you should enable "browser_mode": |
||
| − | <pre> |
||
| − | $ cat /etc/autofs.conf |
||
| − | [...] |
||
| − | # to display all available SDS-hd shares on this to the users |
||
| − | browse_mode=yes |
||
| − | [...] |
||
| − | </pre> |
||
| − | otherwise each share-folder will only be visible after a user has mounted. |
||
| − | |||
| − | After changing the configuration, you should restart the autofs daemon, e.g.: |
||
| − | <pre> |
||
| − | $ systemctl restart autofs |
||
| − | </pre> |
||
| − | |||
| − | Of course you can adopt all other autofs options, like timeouts, etc. to the specific needs of your environment or use any other method for dynamically mounting the shares. |
||
| − | |||
| − | == access your data == |
||
| − | '''Attention!''' The access can not be done as root user, because root uses the Kerberosticket of the machine, which does not have data access! |
||
| − | |||
| − | To access your data on SDS@hd you have to fetch a valid kerberos ticket with your SDS@hd user and Servicepassword: |
||
| − | <pre> |
||
| − | > kinit hd_xy123 |
||
| − | Password for hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE: |
||
| − | </pre> |
||
| − | You can check afterwards your kerberos ticket with: |
||
| − | <pre> |
||
| − | > klist |
||
| − | Ticket cache: FILE:/tmp/krb5cc_1000 |
||
| − | Default principal: hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE |
||
| − | |||
| − | Valid starting Expires Service principal |
||
| − | 20.09.2017 04:00:01 21.09.2017 04:00:01 krbtgt/BWSERVICES.UNI-HEIDELBERG.DE@BWSERVICES.UNI-HEIDELBERG.DE |
||
| − | renew until 29.09.2017 13:38:49 |
||
| − | </pre> |
||
| − | |||
| − | Afterwards you should be able to access the mountpoint, which contain all Speichervorhaben exported to your machine: |
||
| − | <pre> |
||
| − | > ls <mountpoint> |
||
| − | sd16j007 sd17c010 sd17d005 |
||
| − | </pre> |
||
| − | |||
| − | == renew a kerberos ticket == |
||
| − | Because a kerberos ticket has a limited lifetime (default: 10 hours, maximum 24 hours) for security reasons, you have to renew your ticket before it expires to prevent access loss. |
||
| − | <pre> |
||
| − | > kinit -R |
||
| − | </pre> |
||
| − | |||
| − | This renewal could only be done for maximum time of 10 Days and as long as the current kerberos ticket is still valid. For renewal of an expired ticket, you have to use again your Servicepassword. |
||
| − | |||
| − | == destroy kerberos ticket == |
||
| − | Even if kerberos tickets are only valid for a limited period of time, a ticket should be destroyed as soon as access is no longer needed to prevent misuse on multi-user systems: |
||
| − | <pre>kdestroy</pre> |
||
| − | |||
| − | == automated kerberos tickets == |
||
| − | <span style="color:red"><strong>'''Attention!''' Keep this generated Keytab safe and use it only in trusted environments!</strong></span> |
||
| − | |||
| − | If your workflow needs a permanent access to SDS@hd for longer than 10 Days, you can use '''ktutil''' to encrypt your Service Password into a keytab file: |
||
| − | |||
| − | ''interactive way:'' |
||
| − | <pre> |
||
| − | ktutil |
||
| − | ktutil: addent -password -p hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE -k 1 -e rc4-hmac |
||
| − | Password for hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE: |
||
| − | ktutil: addent -password -p hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE -k 1 -e aes256-cts |
||
| − | Password for hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE: |
||
| − | ktutil: wkt xy123.keytab |
||
| − | ktuitl: quit |
||
| − | </pre> |
||
| − | |||
| − | ''non-interactive way:'' |
||
| − | <pre> |
||
| − | echo -e "addent -password -p hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE -k 1 -e rc4-hmac\n<your_servicepasword>\n |
||
| − | addent -password -p hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE -k 1 -e aes256-cts\n<your_servicepasword>\nwkt xy123.keytab" | ktutil |
||
| − | </pre> |
||
| − | |||
| − | With this keytab, you can fetch a kerberos ticket without an interactive password: |
||
| − | <pre> |
||
| − | kinit -k -t xy123.keytab hd_xy123 |
||
| − | </pre> |
||
| − | <br> |
||
| − | |||
| − | [[Category:Sds-hd|NFS|Kerberos]] |
||
Latest revision as of 16:49, 19 August 2022
Redirect to:
