Sds-hd nfs

1 Prerequisites

• Attention: To access data served by SDS@hd via CIFS, You need a Service Password. See details Sds-hd_user_access.

• Additionally the access to SDS@hd is currently only available inside the belwue-Network. This means you have to use the VPN Service of your HomeOrganization, if you want to access SDS@hd from outside the bwHPC-Clusters (e.g. via edoroam or from your personal Laptop)

• Authentication for data access via NFSv4 is performed using Kerberostickets. This requires a functioning Kerberos environment on the client!

2 Using NFSv4 for UNIX client

Da der nfs-Zugriff maschinenbasiert ist, müssen neue nfs-Clienten zuvor für den Zugriff registriert werden, um eine eigene Keytab zu erhalten. Die Registrierung erfolgt zur Zeit noch händisch. Hierzu müssen folgende Daten des nfs-Clienten an das SDS@hd Team gesendet werden:

• hostname
• IP address
• short description
• location
• acronym of the Speichervorhabens which should be available on this machine

Nach erfolgreicher Registrierung erhalten Sie die erforderlichen Zugangsdaten.

2.1 mount a nfs share

The usual restrictions for mounting drives under Linux are valid. Usually this can only be done by the superuser "root". For detailed information, please contact the system administrator of your system.

After successfull configuration (s. Prequisites) you can mount your SDS@hd share with the following commands:

> mkdir <mountpoint>
> mount -t nfs4 -o sec=krb5 lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint>

To enable the mounting after a restart, you have to add the following line to the file "/etc/fstab"

   lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/   <mountpoint>   nfs4     sec=krb5     0 0

2.2 access your data

Attention! The access can not be done as root user, because root uses the Kerberosticket of the machine, which does not have data access!

To access your data on SDS@hd you have to fetch a valid kerberos ticket with your SDS@hd user and Servicepassword:

> kinit hd_xy123
Password for hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE: 

You can check afterwards your kerberos ticket with:

> klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE

Valid starting       Expires              Service principal
20.09.2017 04:00:01  21.09.2017 04:00:01  krbtgt/BWSERVICES.UNI-HEIDELBERG.DE@BWSERVICES.UNI-HEIDELBERG.DE
        renew until 29.09.2017 13:38:49

Afterwards you should be able to access the mountpoint, which contain all Speichervorhaben exported to your machine:

> ls <mountpoint>
sd16j007  sd17c010  sd17d005

2.3 renew a kerberos ticket

Because a kerberos ticket has a limited lifetime (default: 10 hours, maximum 24 hours) for security reasons, you have to renew your ticket before it expires to prevent access loss.

> kinit -R

This renewal could only be done for maximum time of 10 Days and .

2.4 automated kerberos tickets

Attention! Keep this generated Keytab safe and use it only in trusted environments!

If your workflow needs a permanent access to SDS@hd for longer than 10 Days, you can use ktutil to encrypt your Service Password into a keytab file:

ktutil
ktutil: addent -password -p hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE -k 1 -e rc4-hmac
    Password for hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE:
ktutil:  addent -password -p hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE -k 1 -e aes256-cts
    Password for hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE:
ktutil:  wkt xy123.keytab
ktuitl: quit

With this keytab, you can acquire a kerberos ticket without an interactive password:

kinit -k -t xy123.keytab hd_xy123