Kerberos-secured NFS shares move access checks from client-supplied UID numbers to RPCSEC_GSS credentials. On a Linux client, the mount succeeds only when the client can obtain Kerberos credentials and the mount request uses a security flavor the server export accepts.
The client side relies on the kernel NFS client, rpc.gssd, realm configuration, and either a host keytab for root-initiated mounts or a user ticket for file access. The sec= option selects krb5 for authentication, krb5i for authentication plus integrity checks, or krb5p for authentication, integrity checks, and encrypted NFS traffic.
A manual mount is the safest first checkpoint before adding an /etc/fstab or autofs entry. Use a fully qualified server name that matches the server's NFS service principal, restart the client NFS target after first-time keytab or /etc/nfs.conf changes, and test file access as the user who should read or write the share.
Steps to mount a Kerberos-secured NFS export on Linux:
- Confirm that the client resolves the same server name used by the NFS service principal.
$ getent hosts files.example.net 192.0.2.10 files.example.net
Do not mount a Kerberos-secured export by raw IP address or by a short name that does not match the server principal, such as nfs/files.example.net@EXAMPLE.NET.
- Install the Kerberos and NFS client packages if the client does not already have them.
$ sudo apt install --assume-yes krb5-user nfs-common nfs-common and krb5-user installed
Use sudo dnf install krb5-workstation nfs-utils on RHEL, CentOS Stream, Fedora, and compatible systems.
- Confirm that the client has a host credential in the system keytab when root will perform the mount.
$ sudo klist -k /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 4 host/workstation.example.net@EXAMPLE.NET
rpc.gssd can use host or NFS service principals from /etc/krb5.keytab for machine credentials. User file access still depends on the user's Kerberos ticket and server-side permissions.
- Restart the client NFS target after adding the first Kerberos keytab or changing /etc/nfs.conf.
$ sudo systemctl restart nfs-client.target
On current Ubuntu packages, this target includes client-side NFS helpers such as rpc-gssd.service. Use the equivalent client NFS service on non-systemd hosts.
- Obtain a Kerberos ticket for the user who should access files on the mounted export.
$ kinit projectuser Password for projectuser@EXAMPLE.NET:
- Confirm that the ticket cache contains the user principal.
$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: projectuser@EXAMPLE.NET Valid starting Expires Service principal 07/05/2026 09:20:14 07/05/2026 19:20:14 krbtgt/EXAMPLE.NET@EXAMPLE.NET
- Create the local mount point.
$ sudo mkdir --parents /mnt/projects
Files already inside /mnt/projects become hidden while the NFS filesystem is mounted there.
- Mount the export with the Kerberos security flavor required by the server.
$ sudo mount -t nfs -o sec=krb5p files.example.net:/srv/nfs/projects /mnt/projects
Use sec=krb5i or sec=krb5 only when the server export allows that same flavor.
- Verify that the mounted path shows the Kerberos security option.
$ findmnt -o TARGET,SOURCE,FSTYPE,OPTIONS /mnt/projects TARGET SOURCE FSTYPE OPTIONS /mnt/projects files.example.net:/srv/nfs/projects nfs4 rw,relatime,vers=4.2,sec=krb5p,##### snipped #####
- Write a validation file as the Kerberos-authenticated user.
$ touch /mnt/projects/kerberos-check.txt
A permission error here usually points to the user's Kerberos ticket, server-side filesystem permissions, identity mapping, or an export security flavor mismatch.
- List the validation file from the mounted export.
$ ls -l /mnt/projects/kerberos-check.txt -rw-r--r-- 1 projectuser projectuser 0 Jul 5 09:22 /mnt/projects/kerberos-check.txt
- Confirm that the user ticket cache now includes the NFS service ticket.
$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: projectuser@EXAMPLE.NET Valid starting Expires Service principal 07/05/2026 09:20:14 07/05/2026 19:20:14 krbtgt/EXAMPLE.NET@EXAMPLE.NET 07/05/2026 09:21:03 07/05/2026 19:20:14 nfs/files.example.net@EXAMPLE.NET
- Remove the validation file if it was created only for the mount test.
$ rm /mnt/projects/kerberos-check.txt
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.
