Required key not available?

Discussion:

pisymbol .

2013-11-25 22:41:43 UTC

Hoping this is the right list after Googling for quite a while.

I am trying to mount a CIFS share on a Windows 7 SP1 using Kerberos
but no matter what I try, it fails with this:

# mount.cifs -o sec=krb5 //tilt.quest.com/Alex_Documents /mnt
mount error(126): Required key not available
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

# uname -a
Linux agalloch 2.6.34.9-69.ie5.fc13.x86_64 #1 SMP Sun Aug 14 22:10:19
EDT 2011 x86_64 x86_64 x86_64 GNU/Linux

# cat /etc/redhat-release
Fedora release 13 (Goddard)

# mount.cifs -V
mount.cifs version: 4.7

# klist -e
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: Administrator-***@public.gmane.org

Valid starting Expires Service principal
11/25/13 17:21:23 11/26/13 03:21:25 krbtgt/QUEST.COM-***@public.gmane.org
renew until 12/02/13 17:21:23, Etype (skey, tkt): ArcFour with
HMAC/md5, ArcFour with HMAC/md5

Some more debugging output:

fs/cifs/sess.c: sess setup type 5
fs/cifs/cifs_spnego.c: key description =
ver=0x2;host=tilt.quest.com;ip4=192.168.17.55;sec=krb5;uid=0x0;user=root;pid=0x4683
fs/cifs/sess.c: ssetup freeing small buf ffff88035ff8a700
CIFS VFS: Send error in SessSetup = -126
fs/cifs/connect.c: CIFS VFS: leaving cifs_mount (xid = 14) rc = -126
CIFS VFS: cifs_mount failed w/return code = -126
...
Slow work thread pool: Ready
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: signing required but server lacks support
CIFS VFS: cifs_mount failed w/return code = -95
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126

# cat /etc/request-keys.conf
...
create cifs.spnetgo * * /usr/sbin/cifs.upcall %k
create dns_resolver * * /usr/sbin/cifs.upcall %k

I can mount using Samba, I can mount using NTLMv1 and v2. But I can
not mount using Kerberos. I can use kvno to get a host ticket with
ease.

Folks, is there anything I'm missing here? Box is joined to AD and can
query all day long.

Thanks!

-aps

Jeff Layton

2013-11-26 02:52:41 UTC

Permalink

On Mon, 25 Nov 2013 17:41:43 -0500

Post by pisymbol .
Hoping this is the right list after Googling for quite a while.
I am trying to mount a CIFS share on a Windows 7 SP1 using Kerberos
# mount.cifs -o sec=krb5 //tilt.quest.com/Alex_Documents /mnt
mount error(126): Required key not available
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
# uname -a
Linux agalloch 2.6.34.9-69.ie5.fc13.x86_64 #1 SMP Sun Aug 14 22:10:19
EDT 2011 x86_64 x86_64 x86_64 GNU/Linux
# cat /etc/redhat-release
Fedora release 13 (Goddard)
# mount.cifs -V
mount.cifs version: 4.7
# klist -e
Ticket cache: FILE:/tmp/krb5cc_0
Valid starting Expires Service principal
renew until 12/02/13 17:21:23, Etype (skey, tkt): ArcFour with
HMAC/md5, ArcFour with HMAC/md5
fs/cifs/sess.c: sess setup type 5
fs/cifs/cifs_spnego.c: key description =
ver=0x2;host=tilt.quest.com;ip4=192.168.17.55;sec=krb5;uid=0x0;user=root;pid=0x4683
fs/cifs/sess.c: ssetup freeing small buf ffff88035ff8a700
CIFS VFS: Send error in SessSetup = -126
fs/cifs/connect.c: CIFS VFS: leaving cifs_mount (xid = 14) rc = -126
CIFS VFS: cifs_mount failed w/return code = -126
...
Slow work thread pool: Ready
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
CIFS VFS: signing required but server lacks support
CIFS VFS: cifs_mount failed w/return code = -95
CIFS VFS: Send error in SessSetup = -126
CIFS VFS: cifs_mount failed w/return code = -126
# cat /etc/request-keys.conf
...
create cifs.spnetgo * * /usr/sbin/cifs.upcall %k

Check your spelling. Should be "cifs.spnego".

Post by pisymbol .
create dns_resolver * * /usr/sbin/cifs.upcall %k
I can mount using Samba, I can mount using NTLMv1 and v2. But I can
not mount using Kerberos. I can use kvno to get a host ticket with
ease.
Folks, is there anything I'm missing here? Box is joined to AD and can
query all day long.
Thanks!
-aps
--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
More majordomo info at http://vger.kernel.org/majordomo-info.html

--
Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+***@public.gmane.org>

pisymbol .

2013-11-26 12:16:09 UTC

Permalink

Post by Jeff Layton
On Mon, 25 Nov 2013 17:41:43 -0500

Check your spelling. Should be "cifs.spnego".

I don't know HOW that happened. But thank you Jeff, now it works. Boy
do I feel dumb.

-aps