NFS : permission denied - home dir NFS Qtree from Netapp

Question

I have centos7 box

NFS Qtree used for home dir from Netapp is able to mount just fine

Export policy shows :

any any any ...ie super user access as well is any

When i am root user on client box , can cd to user home dir of any user

We have SSSD setup & use can login with AD id

when the normal user login The home dir of the user is not able to mount & error is

su - userxxxx

Last login: Fri Feb 26 19:17:03 EST 2021 from s...
su: warning: cannot change directory to .../..: Permission denied
-bash: .../.bash_profile: Permission denied

-bash-4.2$

Here is tcpdump shows

tcpdump -s 192 port nfs -i ens192 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ens192, link-type EN10MB (Ethernet), capture size 192 bytes

19:13:34.696861 IP CLIENTXXX.busboy > NetappXXXX.com.nfs: Flags [S], seq 4251450372, win 29200, options [mss 1460,sackOK,TS val 1258809 ecr 0,nop,wscale 7], length 0
19:13:34.697147 IP NetappXXXX.com.nfs > CLIENTXXX.busboy: Flags [S.], seq 3336189244, ack 4251450373, win 65535, options [mss 8960,nop,wscale 8,sackOK,TS val 1699851922 ecr 1258809], length 0
19:13:34.697169 IP CLIENTXXX.busboy > NetappXXXX.com.nfs: Flags [.], ack 1, win 229, options [nop,nop,TS val 1258809 ecr 1699851922], length 0
19:13:34.697184 IP CLIENTXXX.busboy > NetappXXXX.com.nfs: Flags [P.], seq 1:137, ack 1, win 229, options [nop,nop,TS val 1258809 ecr 1699851922], length 136: NFS request xid 2803191295 132 access [|nfs]
19:13:34.707092 IP NetappXXXX.com.nfs > CLIENTXXX.busboy: Flags [P.], seq 1:125, ack 137, win 257, options [nop,nop,TS val 1699851932 ecr 1258809], length 124: NFS reply xid 2803191295 reply ok 120 access c 0003
19:13:34.707101 IP CLIENTXXX.busboy > NetappXXXX.com.nfs: Flags [.], ack 125, win 229, options [nop,nop,TS val 1258819 ecr 1699851932], length 0
19:13:34.707147 IP CLIENTXXX.busboy > NetappXXXX.com.nfs: Flags [P.], seq 137:281, ack 125, win 229, options [nop,nop,TS val 1258819 ecr 1699851932], length 144: NFS request xid 2819968511 140 lookup [|nfs]
19:13:34.707621 IP NetappXXXX.com.nfs > CLIENTXXX.busboy: Flags [P.], seq 125:389, ack 281, win 257, options [nop,nop,TS val 1699851932 ecr 1258819], length 264: NFS reply xid 2819968511 reply ok 260 lookup fh Unknown/01000000A916668000000000F0F93B00CEC24854A91666800000000061000000
19:13:34.747554 IP CLIENTXXX.busboy > NetappXXXX.com.nfs: Flags [.], ack 389, win 237, options [nop,nop,TS val 1258860 ecr 1699851932], length 0
19:14:34.799582 IP CLIENTXXX.busboy > NetappXXXX.com.nfs: Flags [.], ack 389, win 237, options [nop,nop,TS val 1318912 ecr 1699851932], length 0
19:14:34.799848 IP NetappXXXX.com.nfs > CLIENTXXX.busboy: Flags [.], ack 281, win 257, options [nop,nop,TS val 1699912024 ecr 1258860], length 0

#######################################

fstab entry :- xxx:/vol_home/home xxx nfs vers=3,bg,soft,retrans=4 0 0 #######################################

mount options from client end mount -v |grep -i nfs

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
xx:/vol_home/home on xx type nfs (rw,relatime,vers=3,rsize=65536,wsize=65536,namlen=255,soft,proto=tcp,timeo=600,retrans=4,sec=sys,mountaddr=xxx,mountvers=3,mountport=635,mountproto=udp,local_lock=none,addr=xxx)

#######################################

Any suggestions Please

                Vserver: xxx
              File Path: /vol_home/home
      File Inode Number: 97
         Security Style: mixed
        Effective Style: unix
         DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: -
           UNIX User Id: 0
          UNIX Group Id: 0
         UNIX Mode Bits: 755
 UNIX Mode Bits in Text: rwxr-xr-x
                   ACLs: -

What is the security style for the qtree? When you use file-directory show on the path on the netapp, what does the permission section show? When you use secd authentication show-creds for the user you’re trying to use, what do you see? Lastly, you can check access denied logs on Netapp that might tell you more. — Basil, Feb 27 '21 at 03:00
@Basil thanks for responding .. good points .. let me check & get back .. — user3769149, Feb 27 '21 at 05:06
@Basil - What is the security style for the qtree? - is mixed.. i updated the main question - see above -- with file-directory show .. I could not find exact cmd to use for secd authentication show-creds, unix-user show -vserver .. i used does show only root.nobody and pcuser,. is there any way to grep logs - access denied .. Thanks — user3769149, Feb 27 '21 at 05:26
For the authentication show-creds, you need to be in set diag. That said, you can specify “-unix-user-id” to match the user’s ID. You want the UID being sent from linux to be able to be found with that secd command, and it to have rights to the inode as per the permissions. This kind of error can be an ldap problem. Here is a kb article that may help: https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/Troubleshooting_CIFS_or_SMB_access_denied — Basil, Feb 28 '21 at 11:16
So far i did test with 2 nodes :- 1 with Basic centso7 & only SSSD setup, works... 2nd box Basic CentOS + SSSD setup + CIS hardening -- Does not Work.. So the culprit is at Client end.. Only question remains now why no log at client end give a clue .. i suspected the TCP wrappers .. but no luck.. if anyone has seen it Please give feedback. Thanks — user3769149, Mar 02 '21 at 07:52

NFS : permission denied - home dir NFS Qtree from Netapp

0 Answers0