1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
import ../make-test-python.nix ({ pkgs, lib, ... }:
with lib;
let
krb5 =
{ enable = true;
domain_realm."nfs.test" = "NFS.TEST";
libdefaults.default_realm = "NFS.TEST";
realms."NFS.TEST" =
{ admin_server = "server.nfs.test";
kdc = "server.nfs.test";
};
};
hosts =
''
192.168.1.1 client.nfs.test
192.168.1.2 server.nfs.test
'';
users = {
users.alice = {
isNormalUser = true;
name = "alice";
uid = 1000;
};
};
in
{
name = "nfsv4-with-kerberos";
nodes = {
client = { lib, ... }:
{ inherit krb5 users;
networking.extraHosts = hosts;
networking.domain = "nfs.test";
networking.hostName = "client";
virtualisation.fileSystems =
{ "/data" = {
device = "server.nfs.test:/";
fsType = "nfs";
options = [ "nfsvers=4" "sec=krb5p" "noauto" ];
};
};
};
server = { lib, ...}:
{ inherit krb5 users;
networking.extraHosts = hosts;
networking.domain = "nfs.test";
networking.hostName = "server";
networking.firewall.allowedTCPPorts = [
111 # rpc
2049 # nfs
88 # kerberos
749 # kerberos admin
];
services.kerberos_server.enable = true;
services.kerberos_server.realms =
{ "NFS.TEST".acl =
[ { access = "all"; principal = "admin/admin"; } ];
};
services.nfs.server.enable = true;
services.nfs.server.createMountPoints = true;
services.nfs.server.exports =
''
/data *(rw,no_root_squash,fsid=0,sec=krb5p)
'';
};
};
testScript =
''
server.succeed("mkdir -p /data/alice")
server.succeed("chown alice:users /data/alice")
# set up kerberos database
server.succeed(
"kdb5_util create -s -r NFS.TEST -P master_key",
"systemctl restart kadmind.service kdc.service",
)
server.wait_for_unit("kadmind.service")
server.wait_for_unit("kdc.service")
# create principals
server.succeed(
"kadmin.local add_principal -randkey nfs/server.nfs.test",
"kadmin.local add_principal -randkey nfs/client.nfs.test",
"kadmin.local add_principal -pw admin_pw admin/admin",
"kadmin.local add_principal -pw alice_pw alice",
)
# add principals to server keytab
server.succeed("kadmin.local ktadd nfs/server.nfs.test")
server.succeed("systemctl start rpc-gssd.service rpc-svcgssd.service")
server.wait_for_unit("rpc-gssd.service")
server.wait_for_unit("rpc-svcgssd.service")
client.wait_for_unit("network-online.target")
# add principals to client keytab
client.succeed("echo admin_pw | kadmin -p admin/admin ktadd nfs/client.nfs.test")
client.succeed("systemctl start rpc-gssd.service")
client.wait_for_unit("rpc-gssd.service")
with subtest("nfs share mounts"):
client.succeed("systemctl restart data.mount")
client.wait_for_unit("data.mount")
with subtest("permissions on nfs share are enforced"):
client.fail("su alice -c 'ls /data'")
client.succeed("su alice -c 'echo alice_pw | kinit'")
client.succeed("su alice -c 'ls /data'")
client.fail("su alice -c 'echo bla >> /data/foo'")
client.succeed("su alice -c 'echo bla >> /data/alice/foo'")
server.succeed("test -e /data/alice/foo")
with subtest("uids/gids are mapped correctly on nfs share"):
ids = client.succeed("stat -c '%U %G' /data/alice").split()
expected = ["alice", "users"]
assert ids == expected, f"ids incorrect: got {ids} expected {expected}"
'';
})
|