Re: Question on current state of sec=krb5* integration in cifs.ko

Holger Rauch <[email protected]> Fri, 23 Oct 2009 17:46:02 +0200

Newsgroups	gmane.linux.file-systems.cifs
Organization	EMPIC GmbH, Werner-von-Siemens-Str. 61, 91052 Erlangen, Germany, Reg. No: 2873 / Fuerth / Germany, CEO / Managing Director: Joerg K. Kottenbrink, WWW: http://www.empic.eu
Message-ID	<[email protected]>

Hi Jeff,

thanks again for replying that quickly. I tried sec=krb5 and it indeed
worked (even in conjunction with autofs5). Strangely enough, it even
continued to work when the credentials cache was empty (having run
"kdestroy" deliberately in order to test Kerberos security).

I could add files even though there were no tickets left in the cache.
This shouldn't be the case, I think (at least that's how it works on
NFSv4; i.e. on NFSv4 I would get "permission denied" when tickets are
either expired or not present). Is CIFS different in this regard?

On Fri, 23 Oct 2009, Jeff Layton wrote:

> [...]
> > [8046557.008389]  fs/cifs/cifssmb.c: Must sign - secFlags 0x1009
> > [8046557.015170]  CIFS VFS: signing required but server lacks support
> 
> 
> I think this message explains the problem ^^^^
> 
> You've request krb5i, but your server doesn't support signing. You
> might want to try sec=krb5 and see if that works.

What exactly is meant by "server" (Samba software, MIT Kerberos
software, etc.)? Do I need a more recent Samba, MIT Kerberos, anything
else?

Thanks again & kind regards,

       Holger

_______________________________________________
linux-cifs-client mailing list
[email protected]
https://lists.samba.org/mailman/listinfo/linux-cifs-client

signature.asc (application/pgp-signature, 197 B)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkrhz7oACgkQbiVtWpZdKQKtGwCgl7LU+EE7xZYvV2k3RtOVgv8X
TMEAn0hjz7CzjOZmuFk0/3S/DGwsnPxq
=N1l8
-----END PGP SIGNATURE-----