OK, create a user for cifs, e.g. cifsuser and use ktutil to stick his key into /etc/cifs.keytab
Make sure that /etc/requestkey.conf has this line:
:
create cifs.spnego * * /usr/sbin/cifs.upcall -K /etc/cifs.keytab %k
(notice, there's no -c which told mount to look for a key beginning with cifs/ in very old versions of cifs-utils)
the -K /etc/cifs.keytab bit is if you applied the patch to cifs-utils which Jeff Layton sent me. I asked if we could have a switch to choose another keytab other than /etc/krb5.keytab. And he just did it:) If not, stick cifsuser in /etc/krb5.conf and miss off the -d /etc/cifs.keytab
Notes:
You don't need to have a separate keytab. It's just as good to mount the share with something you already have in the default keytab, /etc/krb5.keytab e.g. the machine key:
mount -t cifs //yourserver/share /share -osec=krb5, username=MACHINE$,multiuser
You need cifs utils >= 6.1 from here or an up to date distro.
Notes:
You don't need to have a separate keytab. It's just as good to mount the share with something you already have in the default keytab, /etc/krb5.keytab e.g. the machine key:
mount -t cifs //yourserver/share /share -osec=krb5, username=MACHINE$,multiuser
You need cifs utils >= 6.1 from here or an up to date distro.
