Why does nfs-client.target include rpc.svcgssd?

Why does nfs-client.target include rpc.svcgssd?

[Aram Akhavan]

Hi all,

I'm a newbie starting to play around with kerberized nfs on Debian. I 
noticed that in the systemd target file nfs-client.target 
<http://git.linux-nfs.org/?p=steved/nfs-utils.git;a=blob;f=systemd/nfs-client.target;h=8a8300a1dfc6e6a77dfe0abed9942ded8f6b0103;hb=refs/heads/master> 
has *rpc-svcgssd* among its list of dependencies. From the man pages 
<https://linux.die.net/man/8/rpc.svcgssd>, it seems this is a 
server-side daemon, not client-, and as expected I don't seem to need it 
for the clients to mount anything successfully. Why is this part of the 
client target?

I thought it may be a dependency for something else, but I haven't been 
able to find what. Similarly, why is it installed with the *nfs-common* 
package instead of *nfs-kernel-server* if it's not needed?

This came up because I kept seeing errors on boot caused by rpc.svcgssd 
looking for nfs//FQDN/@/REALM /in the keytab, but it doesn't exist. 
rpc.gssd, on the other hand, was updated 
<https://linux.die.net/man/8/rpc.gssd> to search for other principals, 
like host/FQDN@REALM, which is what gets set up in the keytab by default.

Thanks,

Aram

Re: Why does nfs-client.target include rpc.svcgssd?

[Chuck Lever III]

> On Sep 27, 2022, at 4:21 PM, Aram Akhavan <aram@nubmail.ca> wrote:
> 
> Hi all,
> 
> I'm a newbie starting to play around with kerberized nfs on Debian. I noticed that in the systemd target file nfs-client.target <http://git.linux-nfs.org/?p=steved/nfs-utils.git;a=blob;f=systemd/nfs-client.target;h=8a8300a1dfc6e6a77dfe0abed9942ded8f6b0103;hb=refs/heads/master> has *rpc-svcgssd* among its list of dependencies. From the man pages <https://linux.die.net/man/8/rpc.svcgssd>, it seems this is a server-side daemon, not client-, and as expected I don't seem to need it for the clients to mount anything successfully. Why is this part of the client target?
> 
> I thought it may be a dependency for something else, but I haven't been able to find what. Similarly, why is it installed with the *nfs-common* package instead of *nfs-kernel-server* if it's not needed?
> 
> This came up because I kept seeing errors on boot caused by rpc.svcgssd looking for nfs//FQDN/@/REALM /in the keytab, but it doesn't exist. rpc.gssd, on the other hand, was updated <https://linux.die.net/man/8/rpc.gssd> to search for other principals, like host/FQDN@REALM, which is what gets set up in the keytab by default.

An NFSv4 client has a small NFS server in it that handles callback operations.
For NFSv4.0, this server can support the use of GSS/Kerberos on the backchannel
connection.

I thought gssproxy made svcgssd obsolete, but I'm probably misinformed.

--
Chuck Lever