Secure Multiprotocol: NFSv4 with Kerberos

This guide covers client-side setup for secure multiprotocol access using NFSv4 with Kerberos authentication (sec=krb5). Users prove their identity via Kerberos tickets from Active Directory.

Why Kerberos for NFS?

Traditional NFS (sec=sys) trusts whatever UID/GID the client claims. Any root user on any client can impersonate any user. NFSv4 with Kerberos changes this by requiring cryptographic proof of identity from a trusted Key Distribution Center (KDC).

Benefits of NFSv4 with Kerberos:

• Cryptographic identity verification — users prove who they are via Kerberos tickets
• Centralized authentication — Active Directory acts as the KDC
• Audit trail — authentication events logged in AD
• Optional encryption — sec=krb5p encrypts all NFS traffic

Prerequisites

• MayaNAS configured with multiprotocol share using sec=krb5 (see Server Setup)
• Linux client (Ubuntu 22.04+, RHEL/Rocky 8+)
• DNS resolving the AD domain (or DC in /etc/hosts)
• Time synchronized with AD (within 5 minutes)
• rpc-gssd service — required for Kerberos NFS mounts

Step 1: Join Linux Client to AD

For full multiprotocol functionality with Kerberos, the Linux client should join the same AD domain as MayaNAS. This enables automatic UID/GID resolution via SSSD.

Install Required Packages

# Ubuntu/Debian
sudo apt install realmd sssd sssd-tools libnss-sss libpam-sss adcli \
    samba-common-bin krb5-user nfs-common

# RHEL/Rocky
sudo dnf install realmd sssd oddjob oddjob-mkhomedir adcli \
    samba-common-tools krb5-workstation nfs-utils

Discover and Join Domain

$ sudo realm discover example.com
example.com
  type: kerberos
  realm-name: EXAMPLE.COM
  domain-name: example.com
  configured: no
  server-software: active-directory
  client-software: sssd

$ sudo realm join example.com -U Administrator
Password for Administrator:

$ realm list
example.com
  type: kerberos
  realm-name: EXAMPLE.COM
  domain-name: example.com
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  login-formats: %U@example.com
  login-policy: allow-realm-logins

$ id administrator@example.com
uid=1428200500(administrator@example.com) gid=1428200513(domain users@example.com) groups=1428200513(domain users@example.com),1428200512(domain admins@example.com)

Step 2: Configure /etc/idmapd.conf

NFSv4 uses username strings for identity mapping. The Domain setting must match between MayaNAS and all clients:

$ sudo vi /etc/idmapd.conf

# Set Domain to match your AD domain:
[General]
Domain = example.com

# Clear idmap cache after changes
$ sudo nfsidmap -c

Step 3: Verify SSSD Configuration

After AD join, SSSD is auto-configured. Verify user resolution works:

$ id testuser@example.com
uid=1428201103(testuser@example.com) gid=1428200513(domain users@example.com) groups=1428200513(domain users@example.com)

If users don't resolve, check SSSD status:

$ sudo systemctl status sssd
$ sudo journalctl -u sssd -n 50

Kerberos Configuration (Auto-configured)

When you join AD with realm join, Kerberos is automatically configured in /etc/krb5.conf. Verify it's correct:

$ cat /etc/krb5.conf

# Should show your realm:
[libdefaults]
    default_realm = EXAMPLE.COM
    dns_lookup_kdc = true

[realms]
    EXAMPLE.COM = {
        kdc = dc.example.com
    }

[domain_realm]
    .example.com = EXAMPLE.COM
    example.com = EXAMPLE.COM

Test Kerberos connectivity:

$ kinit testuser@EXAMPLE.COM
Password for testuser@EXAMPLE.COM:

$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: testuser@EXAMPLE.COM

Valid starting     Expires            Service principal
01/25/26 02:18:25  01/25/26 12:18:25  krbtgt/EXAMPLE.COM@EXAMPLE.COM

Step 4: Mount with sec=krb5

Start Required Services

The rpc-gssd service is critical — without it, Kerberos mounts will fail with "incorrect mount option".

# Start rpc-gssd (it's socket-activated, so just start, don't enable)
$ sudo systemctl start rpc-gssd

# Verify rpc-gssd is running
$ sudo systemctl status rpc-gssd
● rpc-gssd.service - RPC security service for NFS client and server
     Active: active (running)

Obtain Kerberos Ticket

$ kinit testuser@EXAMPLE.COM
Password for testuser@EXAMPLE.COM:

$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: testuser@EXAMPLE.COM

Valid starting     Expires            Service principal
01/25/26 02:18:25  01/25/26 12:18:25  krbtgt/EXAMPLE.COM@EXAMPLE.COM

Mount the Share

# Create mount point
$ sudo mkdir -p /mnt/multishare

# Mount with Kerberos authentication (hostname must match NFS SPN)
$ sudo mount -t nfs4 -o sec=krb5 nas.example.com:/pool/multishare /mnt/multishare

# Verify mount
$ mount | grep multishare
nas.example.com:/pool/multishare on /mnt/multishare type nfs4 (rw,relatime,sec=krb5,...)

Test access as AD user:

$ su - testuser@example.com
$ touch /mnt/multishare/file_from_linux
$ ls -la /mnt/multishare/
drwxrwsr-x 2 root                 domain users@example.com    3 Jan 25 02:25 .
-rw-r--r-- 1 testuser@example.com domain users@example.com    0 Jan 25 02:25 file_from_linux

For persistent mounts, add to /etc/fstab:

nas.example.com:/pool/multishare  /mnt/multishare  nfs4  sec=krb5,_netdev  0  0

Kerberos Security Levels

Option	Auth	Integrity	Encryption	Use Case
sec=krb5	Yes	No	No	Trusted networks, best performance
sec=krb5i	Yes	Yes	No	Detect tampering
sec=krb5p	Yes	Yes	Yes	Full encryption, highest security

Troubleshooting

Symptom	Cause	Fix
"incorrect mount option was specified"	rpc-gssd not running	sudo systemctl start rpc-gssd
Mount fails: "permission denied"	No Kerberos ticket	kinit user@REALM
Files show owner as nobody	idmapd Domain mismatch	Match Domain in /etc/idmapd.conf on server and client
Mount hangs indefinitely	Server NFS SPN not in keytab	On MayaNAS: klist -k /etc/krb5.keytab | grep nfs
Works for root but not users	User doesn't have ticket	Each user must run kinit
"Clock skew too great"	Time not synchronized	sudo chronyc makestep
kinit fails: "Pre-authentication failed"	Wrong password or time skew	Verify password; sync time with DC

Debug Commands

# Check Kerberos tickets
klist

# Test Kerberos connectivity
kinit -V user@EXAMPLE.COM

# Check idmapd mapping
nfsidmap -l

# View mount security type
mount | grep nfs

# Clear all caches
sss_cache -E
nfsidmap -c

# Check NFS debug logs
dmesg | tail -30

Summary

NFSv4 with Kerberos provides enterprise-grade security for NFS access. The setup flow:

1. Join client to AD — realm join example.com -U Administrator
2. Match idmapd Domain — set Domain = example.com in /etc/idmapd.conf
3. Start rpc-gssd — sudo systemctl start rpc-gssd (critical!)
4. Obtain Kerberos ticket — kinit testuser@EXAMPLE.COM
5. Mount with sec=krb5 — mount -t nfs4 -o sec=krb5 server:/share /mnt