API tools faq
paste
Honest_Abe

iscsi+secure NFS

Honest_Abe
May 19th, 2018
59
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 11.41 KB | None | 0 0
raw download clone embed print report
  1.  
  2. NFS+kerberos server--
  3. =========================================
  4.  
  5. [root@cemtos-server2 ~]# uname -a
  6. Linux cemtos-server2.example.exam 3.10.0-693.el7.x86_64 #1 SMP Tue Aug 22 21:09:27 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
  7. [root@cemtos-server2 ~]# cat /etc/krb5.conf
  8. # Configuration snippets may be placed in this directory as well
  9. includedir /etc/krb5.conf.d/
  10.  
  11. [logging]
  12.  default = FILE:/var/log/krb5libs.log
  13.  kdc = FILE:/var/log/krb5kdc.log
  14.  admin_server = FILE:/var/log/kadmind.log
  15.  
  16. [libdefaults]
  17.  dns_lookup_realm = false
  18.  ticket_lifetime = 24h
  19.  renew_lifetime = 7d
  20.  forwardable = true
  21.  rdns = false
  22.  default_realm = EXAMPLE.EXAM
  23.  default_ccache_name = KEYRING:persistent:%{uid}
  24.  
  25. [realms]
  26.  EXAMPLE.EXAM = {
  27.   kdc = Cent-Pro.example.exam
  28.   admin_server = Cent-Pro.example.exam
  29.  }
  30.  
  31. [domain_realm]
  32.  .example.exam = EXAMPLE.EXAM
  33.  example.exam = EXAMPLE.EXAM
  34. [root@cemtos-server2 ~]# cat /etc/exports
  35. /nfs_ker    centos-client2.example.exam(rw,sync,sec=krb5p)
  36. [root@cemtos-server2 ~]# ls -ldZ /nfs_ker/
  37. drwxr-xr-x. root root unconfined_u:object_r:public_content_rw_t:s0 /nfs_ker/
  38.  
  39. [root@cemtos-server2 ~]# firewall-cmd --permanent --list-p
  40. --list-ports      --list-protocols  
  41. [root@cemtos-server2 ~]# firewall-cmd --permanent --list-ports
  42.  
  43. [root@cemtos-server2 ~]#
  44.  
  45. NFS Client -
  46. ======================
  47. [root@centos-client2 ~]# uname -a
  48. Linux centos-client2.example.exam 3.10.0-693.el7.x86_64 #1 SMP Tue Aug 22 21:09:27 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
  49. [root@centos-client2 ~]# cat /etc/krb5.conf
  50. # Configuration snippets may be placed in this directory as well
  51. includedir /etc/krb5.conf.d/
  52.  
  53. [logging]
  54.  default = FILE:/var/log/krb5libs.log
  55.  kdc = FILE:/var/log/krb5kdc.log
  56.  admin_server = FILE:/var/log/kadmind.log
  57.  
  58. [libdefaults]
  59.  dns_lookup_realm = false
  60.  ticket_lifetime = 24h
  61.  renew_lifetime = 7d
  62.  forwardable = true
  63.  rdns = false
  64.  default_realm = EXAMPLE.EXAM
  65.  default_ccache_name = KEYRING:persistent:%{uid}
  66.  
  67. [realms]
  68.  EXAMPLE.EXAM = {
  69.   kdc = Cent-Pro.example.exam
  70.   admin_server = Cent-Pro.example.exam
  71.  }
  72.  
  73. [domain_realm]
  74.  .example.exam = EXAMPLE.EXAM
  75.  example.exam = EXAMPLE.EXAM
  76. [root@centos-client2 ~]# grep nfs4 /etc/fstab
  77. cemtos-server2.example.exam:/nfs_ker    /mnt/nfs_s  nfs4    sec=krb5p,rw,sync,_netdev   0   0
  78. [root@centos-client2 ~]#
  79.  
  80. Iscsi Target -
  81. ======================
  82.  
  83. /> ls
  84. o- / .............................................................................................. [...]
  85.   o- backstores ................................................................................... [...]
  86.   | o- block ....................................................................... [Storage Objects: 1]
  87.   | | o- lun1 .................................... [/dev/iscsiVG/iscsiLV (296.0MiB) write-thru activated]
  88.   | |   o- alua ........................................................................ [ALUA Groups: 1]
  89.   | |     o- default_tg_pt_gp ............................................ [ALUA state: Active/optimized]
  90.   | o- fileio ...................................................................... [Storage Objects: 0]
  91.   | o- pscsi ....................................................................... [Storage Objects: 0]
  92.   | o- ramdisk ..................................................................... [Storage Objects: 0]
  93.   o- iscsi ................................................................................. [Targets: 1]
  94.   | o- iqn.2003-01.org.linux-iscsi.cemtos-server2.x8664:sn.782e6ce61ef6 ....................... [TPGs: 1]
  95.   |   o- tpg1 .................................................................... [no-gen-acls, no-auth]
  96.   |     o- acls ............................................................................... [ACLs: 1]
  97.   |     | o- iqn.2018-05.com.centos:f1d8ac511c61 ....................................... [Mapped LUNs: 1]
  98.   |     |   o- mapped_lun0 ....................................................... [lun0 block/lun1 (rw)]
  99.   |     o- luns ............................................................................... [LUNs: 1]
  100.   |     | o- lun0 ................................ [block/lun1 (/dev/iscsiVG/iscsiLV) (default_tg_pt_gp)]
  101.   |     o- portals ......................................................................... [Portals: 1]
  102.   |       o- 0.0.0.0:3260 .......................................................................... [OK]
  103.   o- loopback ......................
  104.  
  105.  
  106. [root@cemtos-server2 ~]# cat /etc/target/saveconfig.json
  107. {
  108.   "fabric_modules": [],
  109.   "storage_objects": [
  110.     {
  111.       "alua_tpgs": [
  112.         {
  113.           "alua_access_state": 0,
  114.           "alua_access_status": 0,
  115.           "alua_access_type": 3,
  116.           "alua_support_active_nonoptimized": 1,
  117.           "alua_support_active_optimized": 1,
  118.           "alua_support_offline": 1,
  119.           "alua_support_standby": 1,
  120.           "alua_support_transitioning": 1,
  121.           "alua_support_unavailable": 1,
  122.           "alua_write_metadata": 0,
  123.           "implicit_trans_secs": 0,
  124.           "name": "default_tg_pt_gp",
  125.           "nonop_delay_msecs": 100,
  126.           "preferred": 0,
  127.           "tg_pt_gp_id": 0,
  128.           "trans_delay_msecs": 0
  129.         }
  130.       ],
  131.       "attributes": {
  132.         "block_size": 512,
  133.         "emulate_3pc": 1,
  134.         "emulate_caw": 1,
  135.         "emulate_dpo": 0,
  136.         "emulate_fua_read": 0,
  137.         "emulate_fua_write": 1,
  138.         "emulate_model_alias": 1,
  139.         "emulate_rest_reord": 0,
  140.         "emulate_tas": 1,
  141.         "emulate_tpu": 0,
  142.         "emulate_tpws": 0,
  143.         "emulate_ua_intlck_ctrl": 0,
  144.         "emulate_write_cache": 0,
  145.         "enforce_pr_isids": 1,
  146.         "force_pr_aptpl": 0,
  147.         "is_nonrot": 0,
  148.         "max_unmap_block_desc_count": 0,
  149.         "max_unmap_lba_count": 0,
  150.         "max_write_same_len": 65535,
  151.         "optimal_sectors": 4294967288,
  152.         "pi_prot_format": 0,
  153.         "pi_prot_type": 0,
  154.         "queue_depth": 128,
  155.         "unmap_granularity": 0,
  156.         "unmap_granularity_alignment": 0
  157.       },
  158.       "dev": "/dev/iscsiVG/iscsiLV",
  159.       "name": "lun1",
  160.       "plugin": "block",
  161.       "readonly": false,
  162.       "write_back": false,
  163.       "wwn": "053e0c74-2b08-4136-bcd7-64471c7fd3ab"
  164.     }
  165.   ],
  166.   "targets": [
  167.     {
  168.       "fabric": "iscsi",
  169.       "tpgs": [
  170.         {
  171.           "attributes": {
  172.             "authentication": 0,
  173.             "cache_dynamic_acls": 0,
  174.             "default_cmdsn_depth": 64,
  175.             "default_erl": 0,
  176.             "demo_mode_discovery": 1,
  177.             "demo_mode_write_protect": 1,
  178.             "generate_node_acls": 0,
  179.             "login_timeout": 15,
  180.             "netif_timeout": 2,
  181.             "prod_mode_write_protect": 0,
  182.             "t10_pi": 0,
  183.             "tpg_enabled_sendtargets": 1
  184.           },
  185.           "enable": true,
  186.           "luns": [
  187.             {
  188.               "alias": "8ecf9530cc",
  189.               "alua_tg_pt_gp_name": "default_tg_pt_gp",
  190.               "index": 0,
  191.               "storage_object": "/backstores/block/lun1"
  192.             }
  193.           ],
  194.           "node_acls": [
  195.             {
  196.               "attributes": {
  197.                 "dataout_timeout": 3,
  198.                 "dataout_timeout_retries": 5,
  199.                 "default_erl": 0,
  200.                 "nopin_response_timeout": 30,
  201.                 "nopin_timeout": 15,
  202.                 "random_datain_pdu_offsets": 0,
  203.                 "random_datain_seq_offsets": 0,
  204.                 "random_r2t_offsets": 0
  205.               },
  206.               "chap_password": "redhat",
  207.               "chap_userid": "iscsi",
  208.               "mapped_luns": [
  209.                 {
  210.                   "alias": "f8795782b3",
  211.                   "index": 0,
  212.                   "tpg_lun": 0,
  213.                   "write_protect": false
  214.                 }
  215.               ],
  216.               "node_wwn": "iqn.2018-05.com.centos:f1d8ac511c61"
  217.             }
  218.           ],
  219.           "parameters": {
  220.             "AuthMethod": "CHAP,None",
  221.             "DataDigest": "CRC32C,None",
  222.             "DataPDUInOrder": "Yes",
  223.             "DataSequenceInOrder": "Yes",
  224.             "DefaultTime2Retain": "20",
  225.             "DefaultTime2Wait": "2",
  226.             "ErrorRecoveryLevel": "0",
  227.             "FirstBurstLength": "65536",
  228.             "HeaderDigest": "CRC32C,None",
  229.             "IFMarkInt": "2048~65535",
  230.             "IFMarker": "No",
  231.             "ImmediateData": "Yes",
  232.             "InitialR2T": "Yes",
  233.             "MaxBurstLength": "262144",
  234.             "MaxConnections": "1",
  235.             "MaxOutstandingR2T": "1",
  236.             "MaxRecvDataSegmentLength": "8192",
  237.             "MaxXmitDataSegmentLength": "262144",
  238.             "OFMarkInt": "2048~65535",
  239.             "OFMarker": "No",
  240.             "TargetAlias": "LIO Target"
  241.           },
  242.           "portals": [
  243.             {
  244.               "ip_address": "0.0.0.0",
  245.               "iser": false,
  246.               "offload": false,
  247.               "port": 3260
  248.             }
  249.           ],
  250.           "tag": 1
  251.         }
  252.       ],
  253.       "wwn": "iqn.2003-01.org.linux-iscsi.cemtos-server2.x8664:sn.782e6ce61ef6"
  254.     }
  255.   ]
  256. }
  257. ISCSI initiator -
  258. ====================
  259. [root@centos-client2 ~]# cat /etc/iscsi/initiatorname.iscsi
  260. InitiatorName=iqn.2018-05.com.centos:f1d8ac511c61
  261. [root@centos-client2 ~]# cat /etc/iscsi/iscsid.conf | egrep -v '^#|^$'
  262. iscsid.startup = /bin/systemctl start iscsid.socket iscsiuio.socket
  263. node.startup = automatic
  264. node.leading_login = No
  265. node.session.auth.username = iscsi
  266. node.session.auth.password = redhat
  267. node.session.timeo.replacement_timeout = 120
  268. node.conn[0].timeo.login_timeout = 15
  269. node.conn[0].timeo.logout_timeout = 15
  270. node.conn[0].timeo.noop_out_interval = 5
  271. node.conn[0].timeo.noop_out_timeout = 5
  272. node.session.err_timeo.abort_timeout = 15
  273. node.session.err_timeo.lu_reset_timeout = 30
  274. node.session.err_timeo.tgt_reset_timeout = 30
  275. node.session.initial_login_retry_max = 8
  276. node.session.cmds_max = 128
  277. node.session.queue_depth = 32
  278. node.session.xmit_thread_priority = -20
  279. node.session.iscsi.InitialR2T = No
  280. node.session.iscsi.ImmediateData = Yes
  281. node.session.iscsi.FirstBurstLength = 262144
  282. node.session.iscsi.MaxBurstLength = 16776192
  283. node.conn[0].iscsi.MaxRecvDataSegmentLength = 262144
  284. node.conn[0].iscsi.MaxXmitDataSegmentLength = 0
  285. discovery.sendtargets.iscsi.MaxRecvDataSegmentLength = 32768
  286. node.conn[0].iscsi.HeaderDigest = None
  287. node.session.nr_sessions = 1
  288. node.session.iscsi.FastAbort = Yes
  289. node.session.scan = auto
  290.  
  291. [root@centos-client2 ~]# df -hPT -t ext4
  292. Filesystem     Type  Size  Used Avail Use% Mounted on
  293. /dev/sda       ext4  279M  2.1M  258M   1% /mnt/iscsi_initiator
  294. [root@centos-client2 ~]# grep _netdev /etc/fstab | grep -v ^#
  295. cemtos-server2.example.exam:/nfs_ker    /mnt/nfs_s  nfs4    sec=krb5p,rw,sync,_netdev   0   0
  296. UUID="b57e18b0-9514-45dc-904c-5fdf630b6b70" /mnt/iscsi_initiator    ext4    _netdev 0   0
  297. [root@centos-client2 ~]# lsblk
  298. NAME                            MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
  299. sda                               8:0    0  296M  0 disk /mnt/iscsi_initiator
  300. sr0                              11:0    1 1024M  0 rom  
  301. vda                             252:0    0   12G  0 disk
  302. ├─vda1                          252:1    0  300M  0 part /boot
  303. └─vda2                          252:2    0   11G  0 part
  304.   ├─centos_centos--client2-root 253:0    0    7G  0 lvm  /
  305.   ├─centos_centos--client2-swap 253:1    0    1G  0 lvm  [SWAP]
  306.   └─centos_centos--client2-data 253:2    0    3G  0 lvm  /data
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!