docker部署kerberos,群晖nas中nfs开启kerberos校验

背景

nas开启nfs存储共享，默认情况下只能给IP/24做限制, 达不到安全效果

需要增加kerberos策略校验，并且持久化kerberos数据，避免容器重启丢失数据

环境描述

宿主机系统：CentOS Linux release 7.9.2009 (Core)

Docker版本：Docker version 20.10.6, build 370c289

一、容器部署kerberos

​# 注意添加 /etc/hosts
192.168.10.10 kerberosclient.wo.com
192.168.10.10 kerberosserver.wo.com

1.kerberos配置文件

mkdir -p /data/kerberos/dockerfile

cd /data/kerberos/dockerfile

@FQDN@ 后面使用sed更改为大写域名 = WO.COM

@fqdn@ 后面使用sed更改为小写域名 = wo.com

@kdc_server@ kdc服务器地址 = kerberosclient.wo.com

krb5.conf

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
 default_realm = @FQDN@
 default_ccache_name = FILE:/tmp/krb5cc_cli_%{uid}

[realms]
 @FQDN@ = {
  kdc = @kdc_server@
  admin_server = @kdc_server@
  admin_keytab = /var/lib/krb5kdc/admin.keytab
  database_name = /var/lib/krb5kdc/principal
 }

[domain_realm]
 .@fqdn@ = @FQDN@

kadm5.acl

*/admin@@FQDN@ *

kerberos.sh

#!/bin/bash
fqdn="wo.com"
FQDN="WO.COM"
kd