Chapter 112. Using automount in IdM

Procedure

1. On any IdM-enrolled host, add the NFS service to IdM:

   $ ipa service-add nfs/nfs-server.idm.example.com
   ------------------------------------------------------------
   Added service "nfs/nfs-server.idm.example.com@IDM.EXAMPLE.COM"
   ------------------------------------------------------------
     Principal name: nfs/nfs-server.idm.example.com@IDM.EXAMPLE.COM
     Principal alias: nfs/nfs-server.idm.example.com@IDM.EXAMPLE.COM
     Managed by: nfs-server.idm.example.com

2. On the NFS server, obtain the keytab for the NFS service:

   # ipa-getkeytab -p nfs/nfs-server.idm.example.com -k /etc/krb5.keytab
   Keytab successfully retrieved and stored in: /etc/krb5.keytab

3. On the NFS server, restart the NFS service:

   # systemctl restart nfs-server

4. On the NFS server, enable the NFS service:

   # systemctl enable nfs-server
   Created symlink /etc/systemd/system/multi-user.target.wants/nfs-server.service → /usr/lib/systemd/system/nfs-server.service.

Procedure

1. Create the directory you want to export:

   # mkdir -p /exports/project

2. Give the owner and group the rights to read, write and execute the directory:

   # chmod 770 /exports/project

3. Add the GSID sticky bit so that any files created in the directory will have their group ownership set to that of the directory owner:

   # chmod g+s /exports/project

4. Create an IdM group whose members will be able to access the directory. The example IdM group is developers:

   # ipa group-add developers

5. Change the group ownership of the /exports/project directory to developers so that every IdM user in the group can access it:

   # chgrp developers /exports/project

6. Add an IdM user to the group. The example user is idm_user:

   # ipa group-add-member developers --users=idm_user

7. Create a file in the directory with some content:

   # echo "this is a read-write file" > /exports/project/rw_file

8. To a file in the /etc/exports.d/ directory, add the following information:

   • Which directory you want to export
   • How you want users to authenticate to access the files in the directory

   • What permissions you want users to have on the files in the directory

     # echo "/exports/project *(sec=krb5,rw)" > /etc/exports.d/project.exports

     sec=krb5 uses the Kerberos V5 protocol instead of local UNIX UIDs and GIDs to authenticate users.

   Alternatively, use sec=krb5i or sec=krb5p:

   sec=krb5i

   uses Kerberos V5 for user authentication and performs integrity checking of NFS operations using secure checksums to prevent data tampering.

   sec=krb5p

   uses Kerberos V5 for user authentication, integrity checking, and encrypts NFS traffic to prevent traffic sniffing. This is the most secure setting, but it also involves the most performance overhead.

9. Re-export all directories, synchronizing the main export table kept in /var/lib/nfs/etab with /etc/exports and files under /etc/exports.d:

   # exportfs -r

10. Display the current export list suitable for /etc/exports:

    # exportfs -s
    /exports/project  *(sync,wdelay,hide,no_subtree_check,sec=krb5p,rw,secure,root_squash,no_all_squash)

Procedure

1. Create the raleigh automount location:

   $ ipa automountlocation-add raleigh
   ----------------------------------
   Added automount location "raleigh"
   ----------------------------------
     Location: raleigh

2. Create an auto.devel automount map in the raleigh location:

   $ ipa automountmap-add raleigh auto.devel
   --------------------------------
   Added automount map "auto.devel"
   --------------------------------
     Map: auto.devel

3. Add the keys and mount information for the exports/ share:

   1. Add the key and mount information for the auto.devel map:

      $ ipa automountkey-add raleigh auto.devel --key='*' --info='-sec=krb5p,vers=4 nfs-server.idm.example.com:/exports/&'
      -----------------------
      Added automount key "*"
      -----------------------
        Key: *
        Mount information: -sec=krb5p,vers=4 nfs-server.idm.example.com:/exports/&

   2. Add the key and mount information for the auto.master map:

      $ ipa automountkey-add raleigh auto.master --key=/devel --info=auto.devel
      ----------------------------
      Added automount key "/devel"
      ----------------------------
        Key: /devel
        Mount information: auto.devel

Procedure

1. On the IdM client, enter the ipa-client-automount command and specify the location. Use the -U option to run the script unattended:

   # ipa-client-automount --location raleigh -U

2. Stop the autofs service, clear the SSSD cache, and start the autofs service to load the new configuration settings:

   # systemctl stop autofs ; sss_cache -E ; systemctl start autofs

Procedure

1. Verify that the IdM user can access the read-write directory:

   1. Connect to the IdM client as the IdM user:

      $ ssh idm_user@idm-client.idm.example.com
      Password:

   2. Obtain the ticket-granting ticket (TGT) for the IdM user:

      $ kinit idm_user

   3. [Optional] View the group membership of the IdM user:

      $ ipa user-show idm_user
        User login: idm_user
        [...]
        Member of groups: developers, ipausers

   4. Navigate to the /devel/project directory:

      $ cd /devel/project

   5. List the directory contents:

      $ ls
      rw_file

   6. Add a line to the file in the directory to test the write permission:

      $ echo "idm_user can write into the file" > rw_file

   7. [Optional] View the updated contents of the file:

      $ cat rw_file
      this is a read-write file
      idm_user can write into the file

   The output confirms that idm_user can write into the file.