Dylan L提出的问题 -unix

Dylan L

Asked: 2022-10-29 09:31:20 +0800 CST

apt 想要安装不存在的 docker.io 版本

我在完全更新的 Debian 11 (bullseye) 上遇到问题，并且我已经用尽了关于该主题的故障排除知识。我目前正在运行 3 台 PC，它们都具有由 Ansible 管理的几乎相同的配置。这三个系统中的一个，也是唯一一个在尝试apt install docker.io通过 Ansible（以 root 身份）或手动（例如sudo apt install docker.io）时抛出错误：

~ » sudo apt install docker.io
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following package was automatically installed and is no longer required:
  linux-image-5.10.0-15-amd64
Use 'sudo apt autoremove' to remove it.
The following additional packages will be installed:
  cgroupfs-mount containerd libintl-perl libintl-xs-perl libmodule-find-perl libmodule-scandeps-perl libproc-processtable-perl libsort-naturally-perl libterm-readkey-perl needrestart runc tini
Suggested packages:
  containernetworking-plugins docker-doc aufs-tools btrfs-progs debootstrap rinse rootlesskit xfsprogs zfs-fuse | zfsutils-linux needrestart-session | libnotify-bin iucode-tool
Recommended packages:
  criu
The following NEW packages will be installed:
  cgroupfs-mount containerd docker.io libintl-perl libintl-xs-perl libmodule-find-perl libmodule-scandeps-perl libproc-processtable-perl libsort-naturally-perl libterm-readkey-perl needrestart runc tini
0 upgraded, 13 newly installed, 0 to remove and 0 not upgraded.
Need to get 40.0 MB/61.4 MB of archives.
After this operation, 270 MB of additional disk space will be used.
Do you want to continue? [Y/n] y
Err:1 http://deb.debian.org/debian bullseye/main amd64 runc amd64 1.0.0~rc93+ds1-5+b2
  404  Not Found [IP: 2a04:4e42:a::644 80]
Err:2 http://deb.debian.org/debian bullseye/main amd64 docker.io amd64 20.10.5+dfsg1-1+deb11u1
  404  Not Found [IP: 2a04:4e42:a::644 80]
Err:3 http://deb.debian.org/debian bullseye/main amd64 libintl-perl all 1.26-3
  404  Not Found [IP: 2a04:4e42:a::644 80]
Err:4 http://deb.debian.org/debian bullseye/main amd64 libintl-xs-perl amd64 1.26-3
  404  Not Found [IP: 2a04:4e42:a::644 80]
E: Failed to fetch http://deb.debian.org/debian/pool/main/r/runc/runc_1.0.0%7erc93%2bds1-5%2bb2_amd64.deb  404  Not Found [IP: 2a04:4e42:a::644 80]
E: Failed to fetch http://deb.debian.org/debian/pool/main/d/docker.io/docker.io_20.10.5%2bdfsg1-1%2bdeb11u1_amd64.deb  404  Not Found [IP: 2a04:4e42:a::644 80]
E: Failed to fetch http://deb.debian.org/debian/pool/main/libi/libintl-perl/libintl-perl_1.26-3_all.deb  404  Not Found [IP: 2a04:4e42:a::644 80]
E: Failed to fetch http://deb.debian.org/debian/pool/main/libi/libintl-perl/libintl-xs-perl_1.26-3_amd64.deb  404  Not Found [IP: 2a04:4e42:a::644 80]
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

我试过的

我已经验证我已经连接到互联网，我可以在受影响的机器上连接到Firefox 中的http://deb.debian.org/debian，我可以通过更新 Apt 的包信息sudo apt update，我可以通过升级包sudo apt upgrade。

编辑： sudo apt update返回以下输出：

~ » sudo apt update
Hit:1 http://deb.debian.org/debian bullseye InRelease
Hit:2 http://security.debian.org/debian-security bullseye-security InRelease                                           
Hit:3 http://deb.debian.org/debian bullseye-updates InRelease                                                                                 
Hit:4 http://deb.debian.org/debian bullseye-backports InRelease                                                                               
Hit:5 https://updates.signal.org/desktop/apt xenial InRelease                                                                                
Hit:6 https://packages.element.io/debian default InRelease                       
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.

我已经等了至少一个星期，看看是否有可能通过更新解决的上游问题。没变。

我在这里搜索过类似的问题并阅读了前十名左右；我还没有看到有人提出并解决类似的问题。

我尝试通过 apt 挖掘可用版本。apt show docker.io --all-versions在所有三台机器上运行会产生：

On working machine "M": 20.10.5+dfsg1-1+deb11u2
On working machine "Z": 20.10.5+dfsg1-1+deb11u2
On broken machine "T":  20.10.5+dfsg1-1+deb11u1

我试过手动安装机器 M 和 Z 的版本：

~ » sudo apt install docker.io=20.10.5+dfsg1-1+deb11u2
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Version '20.10.5+dfsg1-1+deb11u2' for 'docker.io' was not found

我试过使用--fix-missing. 完整输出：

~ » sudo apt install docker.io --fix-missing
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following package was automatically installed and is no longer required:
  linux-image-5.10.0-15-amd64
Use 'sudo apt autoremove' to remove it.
The following additional packages will be installed:
  cgroupfs-mount containerd libintl-perl libintl-xs-perl libmodule-find-perl
  libmodule-scandeps-perl libproc-processtable-perl libsort-naturally-perl libterm-readkey-perl
  needrestart runc tini
Suggested packages:
  containernetworking-plugins docker-doc aufs-tools btrfs-progs debootstrap rinse rootlesskit
  xfsprogs zfs-fuse | zfsutils-linux needrestart-session | libnotify-bin iucode-tool
Recommended packages:
  criu
The following NEW packages will be installed:
  cgroupfs-mount containerd docker.io libintl-perl libintl-xs-perl libmodule-find-perl
  libmodule-scandeps-perl libproc-processtable-perl libsort-naturally-perl libterm-readkey-perl
  needrestart runc tini
0 upgraded, 13 newly installed, 0 to remove and 0 not upgraded.
Need to get 40.0 MB/61.4 MB of archives.
After this operation, 270 MB of additional disk space will be used.
Do you want to continue? [Y/n] y
Err:1 http://deb.debian.org/debian bullseye/main amd64 runc amd64 1.0.0~rc93+ds1-5+b2
  404  Not Found [IP: 2a04:4e42:a::644 80]
Err:2 http://deb.debian.org/debian bullseye/main amd64 docker.io amd64 20.10.5+dfsg1-1+deb11u1
  404  Not Found [IP: 2a04:4e42:a::644 80]
Err:3 http://deb.debian.org/debian bullseye/main amd64 libintl-perl all 1.26-3
  404  Not Found [IP: 2a04:4e42:a::644 80]
Err:4 http://deb.debian.org/debian bullseye/main amd64 libintl-xs-perl amd64 1.26-3
  404  Not Found [IP: 2a04:4e42:a::644 80]
Selecting previously unselected package cgroupfs-mount.
(Reading database ... 199957 files and directories currently installed.)
Preparing to unpack .../0-cgroupfs-mount_1.4_all.deb ...
Unpacking cgroupfs-mount (1.4) ...
Selecting previously unselected package containerd.
Preparing to unpack .../1-containerd_1.4.13~ds1-1~deb11u2_amd64.deb ...
Unpacking containerd (1.4.13~ds1-1~deb11u2) ...
Selecting previously unselected package libmodule-find-perl.
Preparing to unpack .../2-libmodule-find-perl_0.15-1_all.deb ...
Unpacking libmodule-find-perl (0.15-1) ...
Selecting previously unselected package libmodule-scandeps-perl.
Preparing to unpack .../3-libmodule-scandeps-perl_1.30-1_all.deb ...
Unpacking libmodule-scandeps-perl (1.30-1) ...
Selecting previously unselected package libproc-processtable-perl.
Preparing to unpack .../4-libproc-processtable-perl_0.59-2+b1_amd64.deb ...
Unpacking libproc-processtable-perl (0.59-2+b1) ...
Selecting previously unselected package libsort-naturally-perl.
Preparing to unpack .../5-libsort-naturally-perl_1.03-2_all.deb ...
Unpacking libsort-naturally-perl (1.03-2) ...
Selecting previously unselected package libterm-readkey-perl.
Preparing to unpack .../6-libterm-readkey-perl_2.38-1+b2_amd64.deb ...
Unpacking libterm-readkey-perl (2.38-1+b2) ...
Selecting previously unselected package tini.
Preparing to unpack .../7-tini_0.19.0-1_amd64.deb ...
Unpacking tini (0.19.0-1) ...
Setting up libmodule-find-perl (0.15-1) ...
Setting up tini (0.19.0-1) ...
Setting up libproc-processtable-perl (0.59-2+b1) ...
Setting up cgroupfs-mount (1.4) ...
Setting up libterm-readkey-perl (2.38-1+b2) ...
dpkg: dependency problems prevent configuration of containerd:
 containerd depends on runc (>= 0.1.0~); however:
  Package runc is not installed.

dpkg: error processing package containerd (--configure):
 dependency problems - leaving unconfigured
Setting up libsort-naturally-perl (1.03-2) ...
Setting up libmodule-scandeps-perl (1.30-1) ...
Processing triggers for man-db (2.9.4-2) ...
Errors were encountered while processing:
 containerd
E: Failed to fetch http://deb.debian.org/debian/pool/main/r/runc/runc_1.0.0%7erc93%2bds1-5%2bb2_amd64.deb  404  Not Found [IP: 2a04:4e42:a::644 80]
E: Failed to fetch http://deb.debian.org/debian/pool/main/d/docker.io/docker.io_20.10.5%2bdfsg1-1%2bdeb11u1_amd64.deb  404  Not Found [IP: 2a04:4e42:a::644 80]
E: Failed to fetch http://deb.debian.org/debian/pool/main/libi/libintl-perl/libintl-perl_1.26-3_all.deb  404  Not Found [IP: 2a04:4e42:a::644 80]
E: Failed to fetch http://deb.debian.org/debian/pool/main/libi/libintl-perl/libintl-xs-perl_1.26-3_amd64.deb  404  Not Found [IP: 2a04:4e42:a::644 80]
E: Sub-process /usr/bin/dpkg returned an error code (1)

（然后系统处于损坏状态， Apt 建议 I run apt --fix-broken install。由于同样的问题，失败了。要恢复系统，我必须运行apt remove containerd并apt autoremove采取良好措施。）

我在 Firefox 中打开https://deb.debian.org/debian/pool/main/d/docker.io/并观察到版本 20.10.5+dfsg1-1+deb11u1 没有 .deb 文件。不过，我不知道为什么这个特定的系统不会安装 +deb11u2 。

基于这个答案，我已经运行apt-cache policy：

# Working machine M
~ » apt-cache policy docker.io
docker.io:
  Installed: 20.10.5+dfsg1-1+deb11u2
  Candidate: 20.10.5+dfsg1-1+deb11u2
  Version table:
 *** 20.10.5+dfsg1-1+deb11u2 500
        500 http://deb.debian.org/debian bullseye/main amd64 Packages
        100 /var/lib/dpkg/status

# Working machine Z
~ » apt-cache policy docker.io
docker.io:
  Installed: 20.10.5+dfsg1-1+deb11u2
  Candidate: 20.10.5+dfsg1-1+deb11u2
  Version table:
 *** 20.10.5+dfsg1-1+deb11u2 500
        500 http://deb.debian.org/debian bullseye/main amd64 Packages
        100 /var/lib/dpkg/status

# Broken machine T
~ » apt-cache policy docker.io
docker.io:
  Installed: (none)
  Candidate: 20.10.5+dfsg1-1+deb11u1
  Version table:
     20.10.5+dfsg1-1+deb11u1 500
        500 http://deb.debian.org/debian bullseye/main amd64 Packages

这似乎没有回答这个问题，所以我通过以下方式查看了可用版本apt-cache madison：

# Working machine M
~ » apt-cache madison docker.io
 docker.io | 20.10.5+dfsg1-1+deb11u2 | http://deb.debian.org/debian bullseye/main amd64 Packages
 docker.io | 20.10.5+dfsg1-1 | http://deb.debian.org/debian bullseye/main Sources
 docker.io | 20.10.5+dfsg1-1+deb11u1 | http://deb.debian.org/debian bullseye/main Sources
 docker.io | 20.10.5+dfsg1-1+deb11u2 | http://deb.debian.org/debian bullseye/main Sources
 docker.io | 20.10.5+dfsg1-1+deb11u2 | http://deb.debian.org/debian bullseye-backports/main Sources

# Working machine Z
~ » apt-cache madison docker.io
 docker.io | 20.10.5+dfsg1-1+deb11u2 | http://deb.debian.org/debian bullseye/main amd64 Packages
 docker.io | 20.10.5+dfsg1-1 | http://deb.debian.org/debian bullseye/main Sources
 docker.io | 20.10.5+dfsg1-1+deb11u1 | http://deb.debian.org/debian bullseye/main Sources
 docker.io | 20.10.5+dfsg1-1+deb11u2 | http://deb.debian.org/debian bullseye/main Sources
 docker.io | 20.10.5+dfsg1-1+deb11u2 | http://deb.debian.org/debian bullseye-backports/main Sources

# Broken machine T
~ » apt-cache madison docker.io
 docker.io | 20.10.5+dfsg1-1+deb11u1 | http://deb.debian.org/debian bullseye/main amd64 Packages
 docker.io | 20.10.5+dfsg1-1 | http://deb.debian.org/debian bullseye/main Sources
 docker.io | 20.10.5+dfsg1-1+deb11u1 | http://deb.debian.org/debian bullseye/main Sources
 docker.io | 20.10.5+dfsg1-1+deb11u2 | http://deb.debian.org/debian bullseye-backports/main Sources

我在 madison 输出中发现的差异是（a）机器 T 在 Packages 行上有 +deb11u1 而不是 +deb11u2 并且（b）机器 T 缺少 +deb11u2 Sources 行。我仍然不明白为什么 Apt 正在寻找丢失的版本，或者不会提供同一存储库中可用的任何其他版本。

我apt-cache showpkg docker.io在机器 T 和 Z 上运行，并仔细比较了输出diff。破机T显示：

~ » apt-cache showpkg docker.io
Package: docker.io
Versions: 
20.10.5+dfsg1-1+deb11u1 (/var/lib/apt/lists/deb.debian.org_debian_dists_bullseye_main_binary-amd64_Packages)
 Description Language: 
                 File: /var/lib/apt/lists/deb.debian.org_debian_dists_bullseye_main_binary-amd64_Packages
                  MD5: 05dc9eba68f3bf418e6a0cf29d555878
 Description Language: en
                 File: /var/lib/apt/lists/deb.debian.org_debian_dists_bullseye_main_i18n_Translation-en
                  MD5: 05dc9eba68f3bf418e6a0cf29d555878


Reverse Depends: 
  runc,docker.io 1.13.1~ds1-2
  docker-compose,docker.io 1.9.0
  lava-dispatcher,docker.io
  lava,docker.io
  containerd,docker.io 1.12
  whalebuilder,docker.io
  toil,docker.io
  subuser,docker.io
  docker-compose,docker.io 1.9.0
  ruby-docker-api,docker.io
  python3-testinfra,docker.io
  piuparts,docker.io
  packer,docker.io
  libnss-docker,docker.io
  lava-dispatcher,docker.io
  lava,docker.io
  due,docker.io
  containerd,docker.io 1.12
  docker-clean,docker.io
  docker-clean,docker.io
  debocker,docker.io
  datalad-container,docker.io
  cwltool,docker.io
  amazon-ecr-credential-helper,docker.io
  charliecloud-builders,docker.io
  amazon-ecr-credential-helper,docker.io
Dependencies: 
20.10.5+dfsg1-1+deb11u1 - init-system-helpers (2 1.54~) libc6 (2 2.4) libdevmapper1.02.1 (2 2:1.02.97) libsystemd0 (0 (null)) adduser (0 (null)) containerd (2 1.4~) iptables (0 (null)) lsb-base (0 (null)) runc (2 1.0.0~rc8~) tini (0 (null)) docker-ce (0 (null)) docker-ce-cli (0 (null)) docker-ce-rootless-extras (0 (null)) apparmor (0 (null)) ca-certificates (0 (null)) cgroupfs-mount (0 (null)) git (0 (null)) needrestart (2 3.1~) xz-utils (0 (null)) docker-doc (0 (null)) aufs-tools (0 (null)) btrfs-progs (0 (null)) debootstrap (0 (null)) e2fsprogs (0 (null)) rinse (0 (null)) rootlesskit (0 (null)) xfsprogs (0 (null)) zfs-fuse (16 (null)) zfsutils-linux (0 (null)) 
Provides: 
20.10.5+dfsg1-1+deb11u1 - 
Reverse Provides:

为简洁起见，我不会在此处发布机器 Z 的输出，但唯一的区别是它在所有 3 个位置都显示 +deb11u2 而不是 +deb11u1。我在这个输出中也没有看到任何解释，AFAICT。

这是我的故障排除知识的限制。发生了什么事，我该如何解决？非常感谢！

Dylan L

Asked: 2022-01-27 21:34:55 +0800 CST

NFS 权限被 sec=krb5p 拒绝

sec=krb5p我正在运行 Debian 11 (Bullseye) 的两台 Hyper-V VM 上使用 MIT Kerberos ( ) 设置 NFSv4.2 。当我使用基于机器的身份验证 ( sec=sys) 时，一切正常。使用 Kerberos ( sec=krb5p)，我可以在客户端上挂载共享，但是Permission denied当我尝试访问共享时会看到。我在下面详细记录了所有这些，包括想到的所有相关配置信息。我有点超出我的深度。我错过了什么或做错了什么？

NFS 与`sec=sys`

/etc/exports 在服务器上：

/exports/ned 192.168.1.0/24(sec=sys,rw,no_subtree_check)

/etc/fstab 在客户端：

test-debian-server:/exports/ned /imports/ned nfs sec=sys 0 0

测试共享：

ned@test-debian-desktop:/imports$ su - -c "nfsstat -m"
Password:
/imports/ned from test-debian-server:/exports/ned
 Flags: rw,relatime,vers=4.2,rsize=262144,wsize=262144,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=192.168.1.63,local_lock=none,addr=192.168.1.62

ned@test-debian-desktop:/imports$ id
uid=2001(ned) gid=2001(ned) groups=2001(ned)
ned@test-debian-desktop:/imports$ ls -l
total 4
drwxr-xr-x 2 ned ned 4096 Jan 26 17:57 ned
ned@test-debian-desktop:/imports$ cd ned
ned@test-debian-desktop:/imports/ned$ ls
ned@test-debian-desktop:/imports/ned$ touch test.txt
ned@test-debian-desktop:/imports/ned$ ls
test.txt

在服务器上验证 test.txt：

ned@test-debian-server:/exports$ id
uid=2001(ned) gid=2001(ned) groups=2001(ned)
ned@test-debian-server:/exports$ ls -l
total 4
drwxr-xr-x 2 ned ned 4096 Jan 26 19:11 ned
ned@test-debian-server:/exports$ ls -l ned
total 0
-rw-r--r-- 1 ned ned 0 Jan 26 19:11 test.txt

权限被拒绝`sec=krb5p`

服务器配置

/etc/主机：

127.0.0.1       localhost
127.0.1.1       test-debian-server.test test-debian-server
192.168.1.63    test-debian-desktop
192.168.1.62    test-debian-server

/etc/default/nfs-内核服务器：

RPCNFSDCOUNT=8
RPCNFSDPRIORITY=0
RPCMOUNTDOPTS="--manage-gids"
NEED_SVCGSSD=""
RPCSVCGSSDOPTS=""

/etc/default/nfs-common:

NEED_STATD=
STATDOPTS=
NEED_IDMAPD=
NEED_GSSD=

/etc/出口：

/exports/ned 192.168.1.0/24(sec=krb5p,rw,no_subtree_check)

/etc/krb5.conf（大量删节）：

[libdefaults]
        default_realm = TEST

        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true

[realms]
        TEST = {
                kdc = test-debian-server
                admin_server = test-debian-server
        }

Kerberos 主体：

root@test-debian-server:~# kadmin.local listprincs
K/M@TEST
host/test-debian-desktop@TEST
host/test-debian-server@TEST
kadmin/admin@TEST
kadmin/changepw@TEST
kadmin/test-debian-server@TEST
kiprop/test-debian-server@TEST
krbtgt/TEST@TEST
nfs/test-debian-desktop@TEST
nfs/test-debian-server@TEST

Kerberos 密钥表：

root@test-debian-server:~# klist -ke
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 nfs/test-debian-server@TEST (aes256-cts-hmac-sha1-96)
   2 nfs/test-debian-server@TEST (aes128-cts-hmac-sha1-96)
   2 host/test-debian-server@TEST (aes256-cts-hmac-sha1-96)
   2 host/test-debian-server@TEST (aes128-cts-hmac-sha1-96)

NFS 有效域：

root@test-debian-server:~# nfsidmap -d
test

出口许可：

root@test-debian-server:~# ls -ld /exports /exports/*
drwxr-xr-x 3 root root 4096 Jan 26 17:58 /exports
drwxr-xr-x 2 ned  ned  4096 Jan 26 19:11 /exports/ned

客户端配置

/etc/主机：

127.0.0.1       localhost
127.0.1.1       test-debian-desktop.test        test-debian-desktop
192.168.1.63    test-debian-desktop
192.168.1.62    test-debian-server

/etc/default/nfs-common：与服务器相同。

/etc/fstab：

test-debian-server:/exports/ned /imports/ned nfs sec=krb5p 0 0

/etc/krb5.conf：与服务器相同。

Kerberos 密钥表：

root@test-debian-desktop:~# klist -ke
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 nfs/test-debian-desktop@TEST (aes256-cts-hmac-sha1-96)
   3 nfs/test-debian-desktop@TEST (aes128-cts-hmac-sha1-96)
   2 host/test-debian-desktop@TEST (aes256-cts-hmac-sha1-96)
   2 host/test-debian-desktop@TEST (aes128-cts-hmac-sha1-96)

NFS 有效域：

root@test-debian-desktop:~# nfsidmap -d
test

进口许可（卸载共享后）：

root@test-debian-desktop:~# umount /imports/ned
root@test-debian-desktop:~# ls -ld /imports /imports/*
drwxr-xr-x 3 root root 4096 Jan 26 19:08 /imports
drwxr-xr-x 2 root root 4096 Jan 26 17:02 /imports/ned

（注意：我的结果是一样的chown ned:ned /imports/ned。我认为root:root是正确的，以防止ned挂载失败时意外写入本地磁盘？）

没有权限

重启服务器和客户端后：

ned@test-debian-desktop:/imports$ su -c "nfsstat -m"
Password:
/imports/ned from test-debian-server:/exports/ned
 Flags: rw,relatime,vers=4.2,rsize=262144,wsize=262144,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=krb5p,clientaddr=192.168.1.63,local_lock=none,addr=192.168.1.62

ned@test-debian-desktop:/imports$ ls -l
total 4
drwxr-xr-x 2 ned ned 4096 Jan 26 19:11 ned
ned@test-debian-desktop:/imports$ cd ned
bash: cd: ned: Permission denied
ned@test-debian-desktop:/imports$

有时ned可以列出ls -l最初的共享但不能cd进入它，如上面的会话；一分钟后，如果ned尝试ls -l，他们将看到文件夹属性的Permission denied问号。ned发生这种情况时，我可以执行以下操作：

ned@test-debian-desktop:/imports$ ls -l
ls: cannot access 'ned': Permission denied
total 0
d????????? ? ? ? ?            ? ned
ned@test-debian-desktop:/imports$ su -c "ls -l /imports"
Password:
total 4
drwxr-xr-x 2 ned ned 4096 Jan 26 19:11 ned
ned@test-debian-desktop:/imports$ ls -l
total 4
drwxr-xr-x 2 ned ned 4096 Jan 26 19:11 ned
ned@test-debian-desktop:/imports$

这似乎是由于属性缓存过期：如果我noac在客户端上的 /etc/fstab 中禁用属性缓存并重新挂载，ned则Permission denied在调用ls -l.

我试过的

在客户端和服务器上，我都有：

设置Verbosity = 4在/etc/idmapd.conf
用于rpcdebug设置nfs、nfsd、nlm和的所有标志rpc
搜索 systemd 日志以获取相关信息（在重新启动并尝试访问共享之后）。

我已经检查systemctl status以确认以下单位是active，并且我已经阅读了为每个单位列出的最近的日记条目（并没有发现明显的错误迹象）：

服务器：
- krb5-管理服务器
- krb5-kdc
- nfs 内核服务器
- nfs-idmapd
- nfs-mountd
- nfs 服务器
- rpc-svcgssd
- rpc-gssd
客户：
- rpc-gssd
- 进口-ned.mount

据我所知，Kerberos 正在正确地进行身份验证。

我已经阅读了我可以找到的所有相关联机帮助页和在线手册，以及 StackExchange 上似乎相关的每个问题，但我无法解决问题或让客户端或服务器生成错误消息来告诉我为什么权限被拒绝。

编辑以根据Unix 应用程序服务器添加host/test-debian-desktop和Kerberos 主体和密钥- MIT Kerberos 文档host/test-debian-server

我错过了什么

选择的答案很好地解释了我的配置不起作用的原因。如果有人遇到同样的情况，以下是我所缺少的详细信息 - 请阅读下面的答案以了解原因。

Kerberos 对单个用户进行身份验证（出于某种原因，我认为它没有）。因此，ned要进行连接，Kerberos 必须有一个主体，并且客户端 PC 上ned@TEST的 Linux 用户必须为该主体获取一个 Ticket-Granting Ticket (TGT)。然后一切都很好。为了或多或少自动化，我做了以下事情：nedkinit

/etc/krb5/user/<uid>/client.keytab：保存密钥，ned并且只能由 ned 读取！我使用0600了权限，所有者和组都为ned.

使用此密钥表，我可以简单地调用kinit -ki登录而无需输入密码。我自动化它的快速而简单的方法是将它添加到 ~/.gnomerc、~/.bashrc ~/.zshrc（因为我使用 Gnome、Bash 和 Zsh）。

此外，由于我通过 Ansible 部署这些配置并且有一些共享点文件但不需要 NFS 访问的系统，因此我对 Bash 和 Zsh 有了一些兴趣，只有kinit在它和客户端 keytab 存在时才运行：

〜/ .bashrc：

# Grab or renew a Kerberos ticket.
if type -t kinit >/dev/null && [[ -r /etc/krb/user/$(id -u)/client.keytab ]]
then
  kinit -ki
fi

〜/ .zshrc：

# Grab or renew a Kerberos ticket.
if type kinit >/dev/null && [[ -r /etc/krb/user/$(id -u)/client.keytab ]]
then
  kinit -ki
fi

apt 想要安装不存在的 docker.io 版本

我试过的

NFS 权限被 sec=krb5p 拒绝

NFS 与`sec=sys`

权限被拒绝`sec=krb5p`

我试过的

我错过了什么

模块 i915 可能缺少固件 /lib/firmware/i915/*

无法获取 jessie backports 存储库

如何将 GPG 私钥和公钥导出到文件

我们如何运行存储在变量中的命令？

如何配置 systemd-resolved 和 systemd-networkd 以使用本地 DNS 服务器来解析本地域和远程 DNS 服务器来解析远程域？

dist-upgrade 后 Kali Linux 中的 apt-get update 错误 [重复]

如何从 systemctl 服务日志中查看最新的 x 行

Nano - 跳转到文件末尾

grub 错误：你需要先加载内核

如何下载软件包而不是使用 apt-get 命令安装它？

Dylan L's questions

我试过的

NFS 与sec=sys

权限被拒绝sec=krb5p

我试过的

我错过了什么

NFS 与`sec=sys`

权限被拒绝`sec=krb5p`