I assume this is 7mode. In cDOT there is no need to have a CIFS license when using Windows KDC.

When doing this in 7mode, you get 2 options for KDC types – Windows and non-Windows.

filer> nfs setup

Enable Kerberos for NFS? y

The filer supports these types of Kerberos Key Distribution Centers (KDCs):

1 - UNIX KDC

2 - Microsoft Active Directory KDC

Enter the type of your KDC (1-2):

When you use Windows as the KDC type, it wants to leverage the CIFS account/krb5.conf file for Kerberos. Thus, the need for a CIFS license.

If you don’t have a CIFS license, choose the UNIX style KDC. Then you would need to set Kerberos up manually like you would with a MIT KDC.

http://www.netapp.com/us/media/tr-3481.pdf

1) Ensure DNS is correct (filer has correct info, DNS server has hostname with forward/reverse lookup)

2) KDC info will be the windows domain name, etc.

3) SPN gets created/added to KDC (and only DES and RC4 is allowed – see TR-4073 on how to do that http://www.netapp.com/us/media/tr-4073.pdf - 7 would be the value for msDs-SupportedEnctypes)

4) Keytab file created on KDC and ported over to the 7mode filer and the krb5.conf is properly populated

Example:

parisi-7mode> nfs setup

Enable Kerberos for NFS? y

The filer supports these types of Kerberos Key Distribution Centers (KDCs):

1 - UNIX KDC

2 - Microsoft Active Directory KDC

Enter the type of your KDC (1-2): 1

Enter the Kerberos realm name: DOMAIN.WIN2K8.NETAPP.COM

Enter the host instance of the NFS server principal name [default: parisi-7mode.domain.win2k8.netapp.com]: nfskrb-7mode.domain.win2k8.netapp.com

NFS setup complete.

parisi-7mode*> options kerberos

kerberos.file_keytab.enable on

kerberos.file_keytab.principal nfskrb-7mode.domain.win2k8.netapp.com

kerberos.file_keytab.realm DOMAIN.WIN2K8.NETAPP.COM

kerberos.multirealm.enable on

kerberos.replay_cache.enable off

[root@centos64 /]# nslookup nfskrb-7mode

Server: 10.228.225.120

Address: 10.228.225.120#53

Name: nfskrb-7mode.domain.win2k8.netapp.com

Address: 10.63.9.69

[root@centos64 /]# nslookup 10.63.9.69

Server: 10.228.225.120

Address: 10.228.225.120#53

69.9.63.10.in-addr.arp

parisi-7mode> exportfs

/vol/vol0/home -sec=sys,rw,nosuid

/vol/vol0 -sec=sys,rw,anon=0,nosuid

/vol/nfs -sec=sys,rw,nosuid

/vol/vfiler1 -sec=sys,rw,nosuid

/vol/cifs -sec=sys,rw,nosuid

/vol/krb5 -sec=krb5,rw,root=10.228.225.140,nosuid

[root@centos64 etc]# mount -o sec=krb5 nfskrb-7mode:/vol/krb5 /krb5

sh-4.1$ cd /krb5

sh-4.1$ klist

Ticket cache: FILE:/tmp/krb5cc_1107

Default principal: ldapuser@DOMAIN.WIN2K8.NETAPP.COM

Valid starting Expires Service principal

03/27/15 16:47:44 04/26/15 16:47:44 krbtgt/DOMAIN.WIN2K8.NETAPP.COM@DOMAIN.WIN2K8.NETAPP.COM

renew until 04/26/15 16:47:44

03/27/15 16:49:46 04/26/15 16:47:44 nfs/nfskrb-7mode.domain.win2k8.netapp.com@DOMAIN.WIN2K8.NETAPP.COM

renew until 04/26/15 16:47:44

sh-4.1$ mount | grep krb5

nfskrb-7mode:/vol/krb5 on /krb5 type nfs (rw,sec=krb5,vers=4,addr=10.63.9.69,clientaddr=10.228.225.140)

From: toasters-bounces@teaparty.net [mailto:toasters-bounces@teaparty.net] On Behalf Of Edward Rolison
Sent: Friday, March 27, 2015 11:03 AM
To: toasters@teaparty.net
Subject: NFSv4/krb against an AD without a CIFS license

Trying to configure NFSv4 and Kerberos - have managed it several times now with boxes that are on the domain, but for various reasons, this one doesn't have a CIFS license.

I'm getting an error:

"unable to setup kerberos for NFS could not set up active directory KDC"

After entering my administrator account in "nfs setup".

Can anyone point me in the direction of what I'm missing here? (Am wondering if it's some variant of needing a machine account created to act as a service principal, or something else is going wrong).

Thanks,

Ed.