Penguinsula

Running Kerberos KDC in a container on Synology NAS

2026-07-31T00:00:00+02:00

In a previous post I described how to run Kerberos KDC (Key Distribution Center) on a Linux desktop client for authentication. The KDC was used to let this same client access NSF shares on a Synology NAS. This worked fine when the Linux desktop was the only client using the Kerberos authentication, since shutting down the Linux desktop makes the KDC unavailable for authentication. Recently I started using a laptop with Linux and also wanted to access the NFS shares from there. Of course I could start up the desktop with KDC each time I use the laptop at home, but that is rather impractical and a waste of energy. Solution: running a lightweight container with Kerberos KDC on the Synology NAS itself. This blogpost will describe how to do that.

Being updated...

Mounting Synology NFSv4 shares in Linux using Kerberos authentication

2023-08-01T00:00:00+02:00

Many people have a Network Attached Storage (NAS) server in their home networks to share files and perhaps function as a private cloud. These NAS servers usually offer different ways (protocols) to share files with devices on the network. Most common protocols are:

The SMB protocol is the standard in Windows networks, whereas NFS is used more in Unix/Linux environments. I have a Synology NAS and have both Linux and Microsoft Windows clients connecting to the fileserver.

SMB works fine on Linux too, but there are a number of advantages in using NFS which I will not detail here. However, certain steps in NFS configuration are especially important to make file permissions work properly/securely with version 4 of the NFS protocol. This has to do with how user accounts on the NAS are mapped and authorized to the user accounts on the Linux client. A quick and dirty setup on the Synology NAS is possible: mapping all connecting NFS clients to a guest account on the NAS. As a consequence, owners of the files created on the NFS share are mapped to user nobody. With this setup I ran into issues with using git on the NFS fileshares since my Linux user was not the owner of the local repository files.

Below I describe how I configured NFSv4 + Kerberos on the Synology NAS and my Linux client in order to work properly with regards to file ownership and permissions. This is by no means an exhaustive description and assumes some prior knowledge on the subjects, but hopefully it gives some form of guidance.

System environment:

NFS Server: Synology DS216+ NAS running DSM 7.1.1-42962 Update 6

NFSv4 (4.0)

NFS Client: Manjaro Linux running a 6.3 kernel

Running Kerberos Key Distribution Center (KDC). In a multi-user network environment you would typically run the KDC on a separate server. However, since my Linux workstation is the only NFS client it does not matter that the KDC is unavailable for authentication when my workstation is offline.

Mounting the NFSv4 share on the Synology NAS.

No DNS on local network

Kerberos

NSFv4 clients are authenticated on user level. This can be done using standard UNIX authentication (AUTH_SYS), but then user accounts on client and NAS need to match on UID/GID level as I understand it. The other authentication method uses Kerberos. Understanding how Kerberos works (high level) takes some time. It is typically one of those things where you will need to read documentation, try things out, re-read documentation and try some more.

Here are a number of resources which I found useful:

Tutorial (kerberos.org)
I suggest to start here.
Official Documentation (web.mit.edu)
This is a collection of separate HTML pages. I found the single pdf file contained in the releases easier to navigate.
Kerberos on Arch Wiki
I run a Manjaro Linux Distribution, which is based on Arch Linux.
Kerberos Tutorial Debian/Ubuntu
Not all parts are applicable to Manjaro (and perhaps not anymore to Debian either?), but still very informative.
Generate Kerberos tickets at login using PAM.
Linux man files on the various config files, programs and protocols.

NFS Client

Enable NFS client services:
$sudo systemctl enable nfs-client.target
The Synology documentation mentions that idmapd needs to be enabled. However, I noticed that the Linux idmapd manual says that only NFSv4 servers need to have that daemon running. The client on newer Linux kernels now uses the nfsidmap program to do name mapping. No need to enable idmapd. However, you do need to set the NFSv4 domain identical to the Kerberos Realm in /etc/idmapd.conf. This config file is used by other programs as well according to the manual page.
Configure/etc/hosts
The hostname of the client (and KDC) must be mapped to the LAN ip address, not the 127.* address.
The hostname of the service/server (NAS) must be mapped to the LAN ip address (unless you have DNS running).
Maintain Kerberos configuration in /etc/krb5.conf
- Section [libdefaults]: set your default_realm to a name you want to use for your Kerberos realm. Convention is to use the DNS domain in capital letters, but if you do not use DNS in your local network you can of course pick something else.
- Section [realms]: map the admin_server and kdcfor your realm to the ip address/FQDN of your linux client.
- Section [domain_realm]: map the domain to your realm.
Add an administrator user to the Kerberos Access Control List /var/lib/krb5kdc/kadm5.acl
See documentation/resources mentioned above regarding the format of this file.
Configure Kerberos database
- After initial creation of the database, use $sudo kadmin_local to add the administrator principal to the database. After having added this principal, you can from now on use $kadmin which interacts with the database via the kadmind daemon.
- Add a standard principal that is your user on the Linux client.
- Add a service principal for the NAS/NFSv4 server.
- Add a service principal for the KDC (the Linux client).
  Restart krb5-kdc and krb5-kadmind services.
  $sudo systemctl restart krb5-kdc. c $sudo systemctl restart krb5-kadmind.
Export the principal key for the server to the /etc/krb5.keytab file using $kadmin.
Every time you generate a new entry for a principal to the KDC database, a key-version-number (kvno) is incremented.
Prepare a mount point for the NFSv4 share.
Add an entry in the /etc/fstab file (type nfs). It is not necessary to indicate any NFS version or other options, defaults will do.
Configure PAM to automatically generate a Kerberos TGT ticket at login.
When you have a Kerberos KDC running with the relevant principals you can use $kinit to generate a TGT ticket. When you try to access the NFS fileshare, a service ticket is automatically generated which grants you this access. In order to have the first step done in the background as well, you need to configure the Pluggable Authentication Modules (PAM). These modules take care of all authentication in Linux. There is a pam-krb5 module that you can install allowing you to enable Kerberos authentication with PAM. This post describes a way how to do that in a pragmatic way. It relies on having both a local login and a Kerberos login with identical passwords, but for me this is fine.

NFS Server

Enable the NFSv4 service in the NAS.
Enter NFSv4 domain/realm under 'Advanced Settings'. No need to change anything regarding the size of the read/write packages. These are negotiated between server and client automatically.

Import the /etc/krbd5.keytabfile from the linux client. In this setup, it should only contain the keys for the service principal we are interested in, the NAS.

Map the principal ID from Kerberos database to a local user on the NAS.

Now the server's Kerberos principal identifier will show on the first screen of the 'Advanced Settings'.

Create NFS permission rule for the file share you want to connect to with the Linux client.
Enter IP address of the Linux client.
Read/write privilege
Do not enable any static mapping here.
Security: choose one of the Kerberos authentication methods.
- Kerberos authentication: krb5 - Authentication only.
- Kerberos integrity: krb5i - Authentication and Integrity Checking.
- Kerberos privacy: krb5p - Authentication, Integrity Checking and Traffic Encryption

After all has been set up and services restarted, you can try to mount the NFSv4 file share on the NAS. You can check the status of the mount using $findmnt -t nfs4
It will show you the details on the NFSv4 file share.

You should now have an NFSv4 share mounted in Linux with authentican handled by Kerberos.

Building a modest Linux Deep Learning machine

2018-08-25T00:00:00+02:00

Some time ago I decided to move from a MacOS development environment back to Linux for exploring and working with Python datascience and statistical modelling libraries. Though most of the Python libraries and platforms offer support for MacOS, things are generally easier in Linux. One avoids a lot of special installation and compatability instructions. My first experience with Linux dates from 1996 when I bought a set of Slackware cdroms. Since then I have used Linux on various types of hardware, but not that much during the last few years. I mainly use Jupyter Notebooks, which are accessed through a webbrowser. So I will just run the Linux machine as a server and work in the notebooks through from my MacOS desktop using a browser. I find the Jupyter notebook a helpful tool, but here are some valid points on its downsides.

A second reason for wanting to switch back to Linux has to do with the fact that I want to take a look at running deep learning models on a Graphics Processing Unit (GPU). My MacOS desktop (iMac) does not have compatible hardware or the possibility of installing such hardware. Today, the GPU's and toolkits from Nvidia are most common and deep learning frameworks like TensorFlow and Theano support mainly those. I must admit that the GPU was not a strict requirement for the new hardware: I am currently interested in probabilistic programming in PyMC3 and those type of models generally do not benefit from running on a GPU. Using the CPU for the computations is often faster! But since i wanted to take a look at Keras/Tensorflow I opted for a GPU anyway, making it the most expensive hardware component in my build...

Below are some details on the hardware and the base installation of the Python libraries. It assumes basic knowledge of hardware components, Linux, Python and Deep Learning frameworks.

Hardware

My objective was not to build a high-end Deep Learning machine with multiple GPU's of the newest hardware available. I wanted to have a reasonably compact and average machine in terms of performance and cost. Checking component compatibility and reviews with help of pcpartpicker was very convenient. The actual installation of the hardware was not very difficult. Carefully read the manual of the motherboard and case. Those will pretty much show you in which order to put things together.

Motherboard: ASUS Prime B250M-Plus
This motherboard has a B250 chipset with support for 6th/7th generation Skylake/Kaby Lake Intel Core processors. Initially I went for the B250M-K which has one slot for GPU instead of two and two slots for RAM instead of four. This would have been fine since I do not intend on running multiple GPU's or upgrade to more RAM. But as it turned out, the B250M-K is not compatible with the case I had bought: it has only one connector for a case fan whereas my case came with two fans. I really liked the case so I decided to change the motherboard since the extra cost was small.
CPU: Intel Core i5 7500 3.4 GHz
A 7th generation Kaby Lake processor with 4 cores from Q1 2017.
CPU Cooler: Cooler Master Hyper 212 EVO
The Intel CPU came with a fan but I bought this one afterwards. Mostly to reduce the noise somewhat. I do not think there would have been any problems with the Intel stock cooler since I am not going to overclock the CPU.
Video Card: ASUS GeForce GTX 1060 6GB Phoenix
Not the newest and most capable GPU on the market, but enough for what I intend to use it for.
Memory: Corsair 16GB (2x 8GB) DDR4 2400MHz CL16 Vengeance
The Motherboard supports a maximum of 64GB DDR4 @ 2400 MHz. It required a BIOS update for the motherboard to run the RAM at 2400MHz.
Storage: Samsung 960 EVO 250GB
I wanted a SSD disk as the main storage disk.
Case: Fractal Design Define Mini C Svart
Nice, compact mATX case. High quality finish and good manual.
Power Supply: Fractal Design Integra M 450W
All the components together do not draw that much power at all. This modest 450 Watt power supply works just fine.

The total price tag for the components was a little more than 1100 USD.

Software

Instead of just copying the installation instructions of the various libraries here, I will just mentioned specific points which I think are especially important. You should read all notes in the context of "At the time of installation". Available versions and dependencies have likely changed since then.

Ubuntu 16.04 LTS
I chose the 16.04 release over the more recent 18.04 because the latter is not explicitly mentioned as being compatible with the Nvidia Cuda Toolkit. Judging from various posts on the Internet there are ways to get it to work in 18.04, but I did not want to take any chances. I installed Ubuntu by means of a boot image on a USB memory stick.
Nvidia CUDA Toolkit 9.0
"The NVIDIA® CUDA® Toolkit provides a development environment for creating high performance GPU-accelerated applications. With the CUDA Toolkit, you can develop, optimize and deploy your applications on GPU-accelerated embedded systems, desktop workstations, enterprise data centers, cloud-based platforms and HPC supercomputers."
TensorFlow with GPU support in Ubuntu requires CUDA Toolkit 9.0. After carefully following the installation and post-installation instructions, I did not encounter any problems with the Ubuntu deb packages. To make sure that my package manager does automatically upgrade to a never version of the toolkit I installed with sudo apt-get install cuda-9.0 instead of sudo apt-get install cuda.
Nvidia cuDNN 7.1.4 for CUDA 9.0
"The NVIDIA CUDA® Deep Neural Network library (cuDNN) is a GPU-accelerated library of primitives for deep neural networks. cuDNN provides highly tuned implementations for standard routines such as forward and backward convolution, pooling, normalization, and activation layers. cuDNN is part of the NVIDIA Deep Learning SDK."
I installed the deb packages as described in the documentation. You will have to register (free) as a developer to be able to download the library.
Anaconda 5.2 (Python 3.6)
I created a conda environment with Python version 3.6 and installed the typical PyData libraries like Pandas, Numpy, Scipy, Matplotlib and Jupyter.
Theano 1.0.2
Bleeding-Edge installation as described in the documentation: pip install from GitHub. I did this within the conda environment. The Ubuntu installation instructions appear a bit dated with regards to the required versions of the dependent libraries. Just install the libraries mentioned using conda install [library]. I installed libgpuarray following the step-by-step system install description (note cmake requirement).
Read the documentation about the configuration of Theano using the .theanorc file.
PyMC3 3.5
PyMC3 is a Python package for Bayesian modelling and relies on Theano for computations. I installed the development branch with pip install from GitHub within the conda environment. When testing some code to see if I could use the GPU with Theano, I found out that PyMC3 tries to do parallel MCMC sampling by default. It assumes that you have multiple GPU's and this will result in a RuntimeError. Specify cores=1 when calling the pm.sample() method. If you have configured Theano to use the CPU instead of the GPU (device = cpu in your .theanorc file), you can enter the number of cores of your cpu. As mentioned earlier, the GPU does generally not speed up computations with PyMC3 models.
TensorFlow 1.9
Installed in the conda environment using pip and the URL of the TensorFlow package with GPU support for Python 3.6.
Keras 2.2.2
Installed in the conda environment using pip. It will use TensorFlow as its backend.

There are of course more base packages and libraries that one would install in a typical development environment, but the above are the main parts with regards to Deep Learning and Bayesian modelling. Furthermore, the modelling and Deep Learning ecosystem for Python is developping fast. Many more frameworks are available. I am looking forward to exploring these!