nfsv4 mounts with kerberos authentication fail to 10.04 LTS server

[Ian Morris]

After upgrading an 11.04 client system to 11.10; kerberos authorised nfsv4 mounts to a 10.04 LTS server fail. In the servers syslog, the error message ERROR: prepare_krb5_rfc_cfx_buffer: not implemented appears.

suspect this could be the same issue as :
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622146

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: nfs-common 1:1.2.4-1ubuntu2
ProcVersionSignature: Ubuntu 3.0.0-12.20-generic 3.0.4
Uname: Linux 3.0.0-12-generic x86_64
ApportVersion: 1.23-0ubuntu3
Architecture: amd64
Date: Sun Oct 16 18:10:34 2011
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Release amd64 (20110426)
ProcEnviron:
 LANGUAGE=en_GB:en
 PATH=(custom, no user)
 LANG=en_GB.UTF-8
 SHELL=/bin/bash
SourcePackage: nfs-utils
UpgradeStatus: Upgraded to oneiric on 2011-10-15 (1 days ago)

[Steve Langasek (vorlon)]

Yes, that's the same issue. This is not a bug that can be fixed in 11.10, but rather one that needs to be fixed in 10.04 by making that release's version of nfs-utils correctly negotiate. Marking as such.

[Ian Morris (ipm)]

Just for the record, the workaround mentioned in the debian bug works here.

Specifically adding

permitted_enctypes = des-cbc-crc
default_tgs_enctypes = des-cbc-crc

to the server's krb5.conf file permits the mounts to proceed.

[Sergio Gelato (sergio-gelato)]

I've backported the relevant patches to the versions of krb5 and nfs-utils currently in lucid(-security). The krb5 one (upstream svn r24603) applied cleanly, while nfs-utils required a bit more work but not much. I'm attaching the latter; to see what I had to change, simply compare it to the corresponding git commit.

My initial tests have been successful: the problem goes away as soon as I update both packages.

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".