diff options
| author | Joachim Falk <joachim.falk@gmx.de> | 2023-01-10 09:55:59 -0500 |
|---|---|---|
| committer | Steve Dickson <steved@redhat.com> | 2023-01-10 09:55:59 -0500 |
| commit | 5faf98a62843d1cda2a0fe15e0878fa1281e42b8 (patch) | |
| tree | c0c26daa51645ad4408585af2c597eb754195f9e | |
| parent | fa12f380fd3c2aa2a6330f1a01100ea9a03b1521 (diff) | |
| download | nfs-utils-5faf98a62843d1cda2a0fe15e0878fa1281e42b8.tar.gz | |
systemd: Don't degrade system state for nfs-clients when krb5 keytab present but not containing the nfs/<FQDN> principalnfs-utils-2-6-3-rc6
The nfs-client.target requires the auth-rpcgss-module.service, which in
turn requires the rpc-svcgssd.service. However, the rpc.svcgssd daemon
is unnecessary for an NFS client, even when using Kerberos security.
Moreover, starting this daemon with its default configuration will fail
when no nfs/<host>@REALM principal is in the Kerberos keytab. Thus,
resulting in a degraded system state for NFS client configurations
without nfs/<host>@REALM principal in the Kerberos keytab. However, this
is a perfectly valid NFS client configuration as the nfs/<host>@REALM
principal is not required for mounting NFS file systems. This is even
the case when Kerberos security is enabled for the mount!
Installing the gssproxy package hides this problem as this disables the
rpc-svcgssd.service.
Link: http://bugs.debian.org/985002
Link: https://salsa.debian.org/kernel-team/nfs-utils/-/merge_requests/23
Signed-off-by: Joachim Falk <joachim.falk@gmx.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
| -rw-r--r-- | systemd/auth-rpcgss-module.service | 2 | ||||
| -rw-r--r-- | systemd/nfs-server.service | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/systemd/auth-rpcgss-module.service b/systemd/auth-rpcgss-module.service index 25c9de8..4a69a7b 100644 --- a/systemd/auth-rpcgss-module.service +++ b/systemd/auth-rpcgss-module.service @@ -8,7 +8,7 @@ Description=Kernel Module supporting RPCSEC_GSS DefaultDependencies=no Before=gssproxy.service rpc-svcgssd.service rpc-gssd.service -Wants=gssproxy.service rpc-svcgssd.service rpc-gssd.service +Wants=gssproxy.service rpc-gssd.service ConditionPathExists=/etc/krb5.keytab ConditionVirtualization=!container diff --git a/systemd/nfs-server.service b/systemd/nfs-server.service index b432f91..2cdd786 100644 --- a/systemd/nfs-server.service +++ b/systemd/nfs-server.service @@ -15,7 +15,7 @@ After=nfsdcld.service Before=rpc-statd-notify.service # GSS services dependencies and ordering -Wants=auth-rpcgss-module.service +Wants=auth-rpcgss-module.service rpc-svcgssd.service After=rpc-gssd.service gssproxy.service rpc-svcgssd.service [Service] |