GSSD(8) GSSD(8) (NAME) gssd, rpc.gssd - RPCSEC_GSS NFS (SYNOPSIS) rpc.gssd [-DfMnlvrHC] [-k keytab] [-p pipefsdir] [-d ccachedir] [-t timeout] [-T timeout] [-U timeout] [-R realm] (INTRODUCTION) RPCSEC_GSS RFC 5403 RPC NFS . RPC RPCSEC_GSS RPC (security context) GSS . GSS-API . (security credentials) . . kinit(1) PAM . (user principal) (user credential) ( kerberos(1) ). . (machine credential) . (service principal) keytab . . . (DESCRIPTION) rpc.gssd GSS-API ( Kerberos) NFS . GSS RPC rpc.gssd . rpc.gssd rpc_pipefs . (User Credentials) kinit(1) UID . NFS RPC rpc.gssd . /tmp . rpc.gssd . -d . (Machine Credentials) rpc.gssd /etc/krb5.keytab . rpc.gssd . $@ root/@ nfs/@ host/@ root/@ nfs/@ host/@ rpc.gssd ( DHCP ) . . . $@ NFS Samba . . /etc/krb5.keytab -k . UID 0 (UID 0) . rpc.gssd UID 0 GSS . . -n rpc.gssd . -n NFSv4 ( SETCLIENTID RENEW) GSS . rpc.gssd ( ) NFSv4 . (Encryption types) (realm) . host/ aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac . rpc.gssd NFS . -DES . -DES -l rpc.gssd . (OPTIONS) -D GSSAPI NFS "servername:/path" . IP ( ) ( ) DNS (canonical) . -D DNS . . -D -D . -f rpc.gssd stderr ( syslogd). -n UID 0 . -k keytab rpc.gssd keytab . /etc/krb5.keytab . -l rpc.gssd des-cbc-crc . Kerberos . -p path rpc.gssd rpc_pipefs . /var/lib/nfs/rpc_pipefs . -d search-path () rpc.gssd . /tmp:/run/user/%U . "%U" UID . -M ( -d ). -M rpc.gssd . -v ( ). -r RPCSEC_GSS ( ). -R realm realm . . -t timeout ( ) GSS . timeout . . -T timeout ( ) RPC gss . . "WARNING: can't create tcp rpc_clnt to server %servername% for user with uid %uid%: RPC: Remote system error - Connection timed out" . -U timeout ( ) upcall. timeout . . . -C -ETIMEDOUT . -H HOME$ "/" . rpc.gssd k5identity k5identity./ . -H rpc.gssd /var/kerberos/krb5/user/$EUID/client.keytab / HOME/.k5identity$ . (CONFIGURATION FILE) [gssd] /etc/nfs.conf . : verbosity -v. rpc-verbosity -r. use-memcache -M. use-machine-creds . false -n . avoid-dns false -D . limit-to-legacy-enctypes -l. allowed-enctypes rpc.gssd krb5 . NFS SHA2 Camellia . . context-timeout -t. rpc-timeout -T. keytab-file -k. cred-cache-directory -d. preferred-realm -R. upcall-timeout -U. cancel-timed-out-upcalls true -C . set-home false -H . use-gss-proxy 1 gssproxy(8) GSSAPI rpc.gssd . gssproxy(8) NFS . https://github.com/gssapi/gssproxy/blob/main/docs/NFS.md#nfs-client . [general] : pipefs-directory -p. (SEE ALSO) rpc.svcgssd(8), kerberos(1), kinit(1), krb5.conf(5), gssproxy(8) (AUTHORS) Dug Song Andy Adamson Marius Aamodt Eriksen J. Bruce Fields nfs-utils GSSD(8)