# NFSv4 with Kerberos on Debian from scratch

This document will (hopefully) allow you to setup a kerberized NFSv4 server on Debian 11/Ubuntu 22.04.

> Copyright (C) 2022 Bruno Raoult ("br")
> Licensed under the GNU Free Documentation License v1.3 or later.
> Some rights reserved. See COPYING.
>
> You should have received a copy of the GNU Free Documentation License along with this document.
> If not, see [this page](https://www.gnu.org/licenses/fdl-1.3-standalone.html).
>
> SPDX-License-Identifier: [GFDL-1.3-or-later](https://spdx.org/licenses/GFDL-1.3-or-later.html)

<!-- markdown-toc start - Don't edit this section. Run M-x markdown-toc-refresh-toc -->
**Table of Contents**
    - [Introduction](#introduction)
    - [Pre-requisites](#pre-requisites)
    - [Kerberos (V5)](#kerberos-v5)
        - [Naming](#naming)
        - [Packages installation](#packages-installation)
        - [Server side](#server-side)
        - [Client side](#client-side)
        - [Testing](#testing)
    - [NFSv4](#nfsv4)
        - [Server side](#server-side-1)
        - [Client side](#client-side-1)
        - [Testing](#testing-1)
    - [Sources](#sources)

<!-- markdown-toc end -->


## Introduction
If you share some files between your machines, your choice was probably [SMB/CIFS](https://en.wikipedia.org/wiki/Server_Message_Block),
as it is supported on nearly any platform (GNU/Linux, MacOS, Windows, iOS, Android,
...).

However, there are some limitations that you may find unacceptable: the loss of uid/gid/permissions and the lack of symbolic/hard links for `SMB`.

Another option (at least on GNU/Linux) could be [SSHFS](https://github.com/libfuse/sshfs): It is simple to use,
and requires no special settings but an ssh access to server. It could be the
ideal sharing system for many people.

What I dislike here is the need for an `ssh` access. No, I don't plan to give an ssh access to **my** servers ;-)

This document is about a third solution : NFSv4 coupled with Kerberos
security, on a [Debian](https://www.debian.org/)-based system (Debian, [Ubuntu](https://ubuntu.com/), etc...).

## Pre-requisites
- [**`NTP`**](https://en.wikipedia.org/wiki/Network_Time_Protocol) : All machines (clients and servers) must be time-synchronized, as Kerberos authentication is partly based on tickets timestamps.
- [**`DNS server`**](https://en.wikipedia.org/wiki/Domain_Name_System) (optional) : Kerberos may, in some configurations make use of some DNS records such as [SRV](https://en.wikipedia.org/wiki/SRV_record) or [TXT](https://en.wikipedia.org/wiki/TXT_record).
  A lightweight DNS server like [dnsmasq](https://dnsmasq.org/) is sufficient, and will avoid the administration of a full-fledged server such as [bind](https://www.isc.org/bind/).

## Kerberos (V5)
There are basically two major implementations of [Kerberos V5](https://datatracker.ietf.org/doc/html/rfc4120) on GNU/Linux: The original [MIT](https://web.mit.edu/kerberos/www/) one, and the [Heimdal](https://github.com/heimdal/heimdal) one. There was also a GNU implementation [Shishi](http://www.gnu.org/software/shishi/), but developement looks stalled for 10+ years.

It appears that the MIT implementation may have some [export restrictions](https://web.mit.edu/kerberos/dist/index.html) due to U.S. regulation. Heimdal implementation (explicitely developed outside the USA, in Sweden) does not suffer such limitations. This document will use the "_un-regulated_" implementation.

### Naming
We will use the following conventions :
#+CAPTION: Table 1: Local names
| Name                  | Value           | Comment                         |
|:----------------------+:----------------+:--------------------------------|
| Kerberos realm        | `LAN`           | Always capital                  |
| Local DNS name        | `lan`           | Typical hostname: machine.lan   |
| Kerberos KDC 1        | `kdc1.lan`      | Primary Key Distribution Center |
| Kerberos KDC 2        | `kdc2.lan`      | Secondary KDC                   |
| Kerberos admin server | `kadmin.lan`    | Administrative server           |
| Kerberos client 1     | `kclient1.lan`  | Test client 1                   |
| Kerberos client 2     | `kclient2.lan`  | Test client 2                   |
| Kerberos credentials  | `krb5/password` | Kerberos admin login/password   |

### Packages installation
On server side, install the necessary packages with :
```
$ sudo apt install krb5-config heimdal-kdc heimdal-servers heimdal-clients heimdal-kcm
```
And on client(s), install the following :

```
$ sudo apt-get install krb5-config heimdal-clients

```
On your desktop, you may also want to install Heimdal [`info`](https://en.wikipedia.org/wiki/Info_(Unix)) documentation with:
```
$ sudo apt-get install heimdal-docs
```
Or, if you prefer HTML, you can install the documentation from source with the following commands :
```
$ git clone https://github.com/heimdal/heimdal.git
$ cd heimdal
$ autoreconf -f -i
$ sh autogen.sh
$ ./configure
$ make html
$ cd doc/heimdal.html
$ sudo cp -ar heimdal.html /usr/share/doc/heimdal-docs/
```

The `krb5-config` package installation will ask you some questions, just fill with the information from Table 1 :
- Default Kerberos version 5 realm: `LAN`
- Kerberos servers for your realm: `kdc1.lan` and `kdc2.lan`
- Administrative server for your Kerberos realm: `kadmin.lan`

After this initial configuration, `/etc/krb5.conf` should contain something like :
```
[libdefaults]
	default_realm = LAN
	kdc_timesync = true
	forwardable = true
	proxiable = true

[realms]
	LAN = {
		kdc = kdc1.lan
		kdc = kdc2.lan
		admin_server = kadmin.lan
	}

[domain_realm]
    lan  = LAN
	.lan = LAN
```
### Server side
###  Client side
### Testing
## NFSv4
### Server side
### Client side
### Testing
## Sources
Kerberos :
- ~heimdal-docs~ package documentation : run `$ info heimdal` or, if you installed HTML documentation, visit [its index page](file:///usr/share/doc/heimdal-docs/heimdal.html/index.html).
- [Heimdal setup on Debian](http://chschneider.eu/linux/server/heimdal.shtml).
- [Debian/Ubuntu Linux with Active Directory Kerberos Server](http://www.cs.rug.nl/~jurjen/ApprenticesNotes/ad_kinit.html)
- [Principal names and DNS](https://web.mit.edu/kerberos/krb5-1.13/doc/admin/princ_dns.html)
- [Setup (MIT) Kerberos Server and Client on Ubuntu 20.04](https://www.atlantic.net/dedicated-server-hosting/how-to-setup-kerberos-server-and-client-on-ubuntu-20-04/)
- [MIT Kerberos Documentation: Installing KDCs](https://web.mit.edu/kerberos/krb5-1.12/doc/admin/install_kdc.html)
- [MIT Kerberos Documentation: Realm configuration decisions](https://web.mit.edu/kerberos/krb5-1.12/doc/admin/realm_config.html#mapping-hostnames)