【LINUX】在redhat6系统中 当NFS启动后 rpc.svcgssd 状态还是STOP

问题描述：在redhat6系统中 当NFS启动后 rpc.svcgssd 状态还是STOP

点击(此处)折叠或打开

 [root@mytest Packages]# cat /etc/redhat-release
 Red Hat Enterprise Linux Server release 6.7 (Santiago)
 [root@mytest Packages]# service rpcbind status
 rpcbind (pid 4744) is running...
 [root@mytest Packages]# service nfs status
 rpc.svcgssd is stopped    -- 问题所在
 rpc.mountd (pid 5733) is running...
 nfsd (pid 5749 5748 5747 5746 5745 5744 5743 5742) is running...
 rpc.rquotad (pid 5728) is running...

描述：如果NFS 配置为 Kerberos 自动共享模式，该服务才会有用或者启动
原文如下：

点击(此处)折叠或打开

 This is an expected behaviour. rpc.svcgssd and rpc.gssd daemons only needs to be enabled if NFS is configured to to export shares via Kerberos authentication

NFS 默认是不配置Kerberos 共享 的

点击(此处)折叠或打开

 NFS service by default is not configured to export shares via Kerberos

Kerberos协议：（此处解释转载自http://www.jb51.net/article/94875.htm）

Kerberos协议主要用于计算机网络的身份鉴别(Authentication), 其特点是用户只需输入一次身份验证信息就可以凭借此验证获得的票据(ticket-granting ticket)访问多个服务，即SSO(Single Sign On)。由于在每个Client和Service之间建立了共享密钥，使得该协议具有相当的安全性。

环境要求：
原文如下，主要是说确保所有的clients与servers之间的时间同步以及DNS正确解析。主机可以通过一个CNAME引用，但主机名必须是一个“A”的记录。按照惯例，Kerberos域都是大写

点击(此处)折叠或打开

 Important points :

 Time Synchronization: All machines that will participate in Kerberos authentication must have a reliable, synchronized time source. Most large organization offer their own time sources. You can use the RHEL configuration tool system-config-time to set this up. So, time of both the server and clients will be same.
 Hostnames : All hosts must have their hostname set to the fully qualified hostname as reported by DNS. Both forward and reverse mapping must work properly.
 The host may be referenced by a CNAME, but the official host name (as reported by hostname) must be an ‘A’ record. This is important; if you don’t have this setup properly then some things will work, while other things will fail mysteriously. If the host name does not match the reverse DNS lookup, Kerberos authentication will fail.
 You need to choose a kerberos realm. A kerberos realm is completely different from a DNS domain, but in most cases you will want to use the same name. By convention, kerberos realms are all upper case. The kerberos realm used in this article will be "EXAMPLE.COM".

安装包需求：

点击(此处)折叠或打开

 On client machine, make it sure that following packages are installed :

 krb5-libs
 krb5-workstation
 pam_krb5
 cyrus-sasl-gssapi
 On server machine, make it sure that following package is installed :

 krb5-server

到此为止，具体怎么配置，可以参考上述中 Kerberos协议：（此处解释转载自http://www.jb51.net/article/94875.htm）地址，官方文档请参考文博目录

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/29487349/viewspace-2141327/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/29487349/viewspace-2141327/