[LU-14263] Kerberos ticket renewal not processed by lustre

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.14.0
• Affects Version/s: Lustre 2.14.0, Lustre 2.12.6
• Labels: sec
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

Sumary: lustre seems to ignore a kerberos ticket being renewed

1. First testFilesystem access is lost after 200s, ticket renewed at 100s

$ lfs flushctx -k
$ keyctl clear $(keyctl show | grep _ses | awk -F ' ' '{print $1}')
$ kinit -l 00:03 -r 00:10
$ keyctl reap
$ date; ls /home | wc -l; sleep 100; date; kinit -R -c /tmp/krb5cc_81265; ls /home | wc -l; sleep 100; date; ls /home | wc -l
Wed Dec 16 16:28:30 CET 2020
73
Wed Dec 16 16:30:10 CET 2020
73
Wed Dec 16 16:31:50 CET 2020
ls: cannot access '/home': Connection refused
0

1. Second test which does regain filesystem access after issuing 'keyctl clear XXX; keyctl reap' right after ticket renewal (we didn't test if this can be done automatically).

$ lfs flushctx -k
$ keyctl clear $(keyctl show | grep _ses | awk -F ' ' '{print $1}')
$ kinit -l 00:03 -r 00:10
$ keyctl reap
$ date; ls /home | wc -l; sleep 100; date; kinit -R -c /tmp/krb5cc_81265; echo CLEAR; keyctl clear $(keyctl show | grep _ses | awk -F ' ' '{print $1}'); keyctl reap; ls /home | wc -l; sleep 100; date; ls /home | wc -l
Wed Dec 16 16:57:12 CET 2020
73
Wed Dec 16 16:58:52 CET 2020
CLEAR
0 keys reaped
73
Wed Dec 16 17:00:33 CET 2020
73