ALT Linux Bugzilla – Full Text Bug Listing
| Summary: | При входе не (авто)монтируется сетевая папка на сервере AD | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Branch p10 | Reporter: | Vera Blagoveschenskaya <vercha> | ||||
| Component: | pam_mount | Assignee: | qa-team <qa-team> | ||||
| Status: | CLOSED WORKSFORME | QA Contact: | qa-p10 <qa-p10> | ||||
| Severity: | normal | ||||||
| Priority: | P5 | CC: | greh, iv, sin, svn17 | ||||
| Version: | не указана | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| See Also: | https://bugzilla.altlinux.org/show_bug.cgi?id=40887 | ||||||
| Attachments: |
|
||||||
|
Description
Vera Blagoveschenskaya
2021-10-19 09:38:50 MSK
Доп. исследование: если привести строчку в pam_mount.conf.xml к виду
<volume uid="10000-2000200000" fstype="cifs" server="10.88.8.226" path="share" mountpoint="~/share"
options="vers=2.0,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775,user=%(USER)" />
То шара монтируется нормально.
Убрала из options параметр sec=krb5 и изменила user=%(USER)
Странное поведение... Хотя возникает вопрос: - у нас, вроде, kerberos; - а почему указан ip-адрес узла, а не его доменное имя? - редко, в каких сетях настроена обратная зона, да и в этом случае могут быть коллизии. Обращаю внимание на этот коммит: https://github.com/samba-team/samba/commit/e25a9e8f4ec8034d2974a887e4f64e99a04f226a Removed SMB (development) dialects ---------------------------------- The following SMB (development) dialects are no longer supported: SMB2_22, SMB2_24 and SMB3_10. They are were only supported by Windows technical preview builds. They used to be useful in order to test against the latest Windows versions, but it's no longer useful to have them. If you have them explicitly specified in your smb.conf or an the command line, you need to replace them like this: - SMB2_22 => SMB3_00 - SMB2_24 => SMB3_00 - SMB3_10 => SMB3_11 Note that it's typically not useful to specify "client max protocol" or "server max protocol" explicitly to a specific dialect, just leave them unspecified or specify the value "default". ____________________________________ В связи с этим хочу уточнить на каком основании была выбрана и явно указан версия протокола vers=2.0? ____________________________________ В man mount.cifs по этому поводу явно указано: vers=arg SMB protocol version. Allowed values are: · 1.0 - The classic CIFS/SMBv1 protocol. · 2.0 - The SMBv2.002 protocol. This was initially introduced in Windows Vista Service Pack 1, and Windows Server 2008. Note that the initial release version of Windows Vista spoke a slightly different dialect (2.000) that is not supported. · 2.1 - The SMBv2.1 protocol that was introduced in Microsoft Windows 7 and Windows Server 2008R2. · 3.0 - The SMBv3.0 protocol that was introduced in Microsoft Windows 8 and Windows Server 2012. · 3.02 or 3.0.2 - The SMBv3.0.2 protocol that was introduced in Microsoft Windows 8.1 and Windows Server 2012R2. · 3.1.1 or 3.11 - The SMBv3.1.1 protocol that was introduced in Microsoft Windows 10 and Windows Server 2016. · 3 - The SMBv3.0 protocol version and above. · default - Tries to negotiate the highest SMB2+ version supported by both the client and server. If no dialect is specified on mount vers=default is used. To check Dialect refer to /proc/fs/cifs/DebugData Note too that while this option governs the protocol version used, not all features of each version are available. The default since v4.13.5 is for the client and server to negotiate the highest possible version greater than or equal to 2.1. In kernels prior to v4.13, the default was 1.0. For kernels between v4.13 and v4.13.5 the default is 3.0. Насколько видно из лога: окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: get_cachename_from_process_env: pathname=/proc/3854/environ окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: get_existing_cc: default ccache is KEYRING:persistent:1084801107:krb_ccache_k4PBNFy окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: handle_krb5_mech: getting service ticket for 10.88.8.226 окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: cifs_krb5_get_req: unable to get credentials for 10.88.8.226 окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: handle_krb5_mech: failed to obtain service ticket (-1765328377) окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: Unable to obtain service ticket окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: Exit status -1765328377 Билет для службы на узле 10.88.8.226 не был найден. Так он и не может быть найден по ip-адресу. Указывать следует доменное имя узла. Закрываю данный issue как worksforme Workaround описан в https://bugzilla.altlinux.org/show_bug.cgi?id=41161#c1 Работает и с доменным именем, и с ip. |
