ALT Linux Bugzilla – #41161

Доп. исследование: если привести строчку в pam_mount.conf.xml к виду

<volume uid="10000-2000200000" fstype="cifs" server="10.88.8.226" path="share" mountpoint="~/share"
    options="vers=2.0,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775,user=%(USER)" />

То шара монтируется нормально.
Убрала из options параметр sec=krb5 и изменила user=%(USER)

Странное поведение... Хотя возникает вопрос:
- у нас, вроде, kerberos;
- а почему указан ip-адрес узла, а не его доменное имя?
- редко, в каких сетях настроена обратная зона, да и в этом случае могут быть коллизии.

Обращаю внимание на этот коммит:
https://github.com/samba-team/samba/commit/e25a9e8f4ec8034d2974a887e4f64e99a04f226a

Removed SMB (development) dialects
----------------------------------

The following SMB (development) dialects are no longer
supported: SMB2_22, SMB2_24 and SMB3_10. They are were
only supported by Windows technical preview builds.
They used to be useful in order to test against the
latest Windows versions, but it's no longer useful
to have them. If you have them explicitly specified
in your smb.conf or an the command line,
you need to replace them like this:
- SMB2_22 => SMB3_00
- SMB2_24 => SMB3_00
- SMB3_10 => SMB3_11
Note that it's typically not useful to specify
"client max protocol" or "server max protocol"
explicitly to a specific dialect, just leave
them unspecified or specify the value "default".

____________________________________



В связи с этим хочу уточнить на каком основании была выбрана и явно указан версия протокола vers=2.0?


____________________________________

В man mount.cifs по этому поводу явно указано:

vers=arg
  SMB protocol version. Allowed values are:
  · 1.0 - The classic CIFS/SMBv1 protocol.
  · 2.0 - The SMBv2.002 protocol. This was initially introduced in Windows Vista Service Pack 1, and Windows Server 2008. Note that the initial release version of Windows  Vista  spoke  a  slightly  different  dialect
    (2.000) that is not supported.
  · 2.1 - The SMBv2.1 protocol that was introduced in Microsoft Windows 7 and Windows Server 2008R2.
  · 3.0 - The SMBv3.0 protocol that was introduced in Microsoft Windows 8 and Windows Server 2012.
  · 3.02 or 3.0.2 - The SMBv3.0.2 protocol that was introduced in Microsoft Windows 8.1 and Windows Server 2012R2.
  · 3.1.1 or 3.11 - The SMBv3.1.1 protocol that was introduced in Microsoft Windows 10 and Windows Server 2016.
  · 3 - The SMBv3.0 protocol version and above.

  · default - Tries to negotiate the highest SMB2+ version supported by both the client and server.

If no dialect is specified on mount vers=default is used.  To check Dialect refer to /proc/fs/cifs/DebugData

Note too that while this option governs the protocol version used, not all features of each version are available.

The  default  since  v4.13.5 is for the client and server to negotiate the highest possible version greater than or equal to 2.1. In kernels prior to v4.13, the default was 1.0. For kernels between v4.13 and v4.13.5 the default is 3.0.

Насколько видно из лога:

окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: get_cachename_from_process_env: pathname=/proc/3854/environ
окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: get_existing_cc: default ccache is KEYRING:persistent:1084801107:krb_ccache_k4PBNFy
окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: handle_krb5_mech: getting service ticket for 10.88.8.226
окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: cifs_krb5_get_req: unable to get credentials for 10.88.8.226
окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: handle_krb5_mech: failed to obtain service ticket (-1765328377)
окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: Unable to obtain service ticket
окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: Exit status -1765328377

Билет для службы на узле 10.88.8.226 не был найден.

Так он и не может быть найден по ip-адресу. Указывать следует доменное имя узла.

Закрываю данный issue как worksforme
Workaround описан в
https://bugzilla.altlinux.org/show_bug.cgi?id=41161#c1
Работает и с доменным именем, и с ip.