Kerberized NFS in RHEL7/CentOS7

The problem with NFS is that it doesnot have host-based authentication. So NFS is vulnerable to man-in-the-middle attack. By using Kerberos, hosts are required to prove their identity before mounting, instead of blindly assuming that the IP they are connecting to is genuine.

For Kerberos Server configuration, refer to this post.

 NOTE: 1) Ensure that DNS Server or '/etc/hosts' file is configured for the network.
             2) Ensure that Time Synchronization is configured on all machines in the network.
             3) All commands are to be executed as 'root' user.

Consider the following scenario:

Kerberos Realm: MYCOMPANY.COM
DNS Domain Name: mycompany.com
Kerberos KDC: meru.mycompany.com
Kerberos Admin Server: meru.mycompany.com

NFS Server: server3.mycompany.com
NFS Client: server1.mycompany.com

Configure NFS Server (server3.mycompany.com):

1) Install packages.
[root@server3 ~]# yum -y install krb5-workstation krb5-libs

2) Edit the file '/etc/krb5.conf'. Make the following changes.
     
       default_realm = MYCOMPANY.COM
       [realms]
       MYCOMPANY.COM = {
       kdc = meru.mycompany.com
       admin_server = meru.mycompany.com
       }

       [domain_realm]
       .mycompany.com = MYCOMPANY.COM
       mycompany.com = MYCOMPANY.COM


   
3) Create nfs principal in the kerberos database and extract keys for the nfs server.
[root@server3 ~]# kadmin -p shabbir/admin -w shabbir
          kadmin:  addprinc -randkey nfs/server3.mycompany.com

          kadmin:  ktadd nfs/server3.mycompany.com
          kadmin:  quit

4) View Keytab entry.
[root@server3 ~]# klist -k

5) Edit the file '/etc/exports' and enable kerberos authentication.
       /home/shabbir   server1.mycompany.com(rw,sec=krb5)


6) Export the dir
[root@server3 ~]# exportfs -avr

7) Start NFS Secure Server and make sure firewall port is open.
[root@server3 ~]# systemctl start nfs-secure-server

[root@server3 ~]# firewall-cmd --zone=public --add-service=nfs --permanent 
[root@server3 ~]# firewall-cmd --reload

Configure NFS Client (server1.mycompany.com):

1) Install packages.
[root@server1 ~]# yum -y install krb5-workstation krb5-libs

2) Edit the file '/etc/krb5.conf'. Make the following changes.
     
       default_realm = MYCOMPANY.COM
       [realms]
       MYCOMPANY.COM = {
       kdc = meru.mycompany.com
       admin_server = meru.mycompany.com
       }

       [domain_realm]
       .mycompany.com = MYCOMPANY.COM
       mycompany.com = MYCOMPANY.COM


3) Create nfs principal in the kerberos database and extract keys for the nfs client.
[root@server1 ~]#     kadmin -p shabbir/admin -w shabbir
          kadmin:  addprinc -randkey nfs/server1.mycompany.com

          kadmin:  ktadd nfs/server1.mycompany.com
          kadmin:  quit

4) View Keytab entry.
[root@server1 ~]# klist -k

5) Start NFS Secure Service.
[root@server1 ~]# systemctl start nfs-secure


6) Mount the exported dir.
[root@server1 ~]# mount -t nfs4  -o sec=krb5  server3.mycompany.com:/home/shabbir  /mnt

7) Login as user 'shabbir' and obtain a  ticket. We assume that user principal for 'shabbir' exists in the Kerberos database.
[root@server1 ~]# su - shabbir
[shabbir@server1 ~]$ kinit shabbir
Password for shabbir@MYCOMPANY.COM:

8) View the ticket
[shabbir@server1 ~]$ klist
Ticket cache: KEYRING:persistent:0:0
Default principal: shabbir@MYCOMPANY.COM

Valid starting       Expires              Service principal
06/06/2015 15:16:28  06/07/2015 15:16:28  krbtgt/MYCOMPANY.COM@MYCOMPANY.COM
    renew until 06/06/2015 15:16:28


9) Access the mounted dir.
[shabbir@server1 ~]$ cd /mnt
[shabbir@server1 ~]$ touch foo123

10) Destroy the ticket.
[shabbir@server1 ~]$ kdestroy