Kerberos NFSv4 mounts from FreeBSD server fails with "mount.nfs4: mount system call failed"

I'm having the same problem (albeit with Linux Mint 17 RC).

Full gssd session output:

jhogg@delves ~ $ sudo rpc.gssd -fvvv
beginning poll
destroying client /run/rpc_pipefs/nfs/clnt4b
Closing 'gssd' pipe for /run/rpc_pipefs/nfs/clnt49
destroying client /run/rpc_pipefs/nfs/clnt4a
destroying client /run/rpc_pipefs/nfs/clnt49
handling gssd upcall (/run/rpc_pipefs/nfs/clnt56)
handle_gssd_upcall: 'mech=krb5 uid=0 service=* enctypes=18,17,16,23,3,1,2 '
handling krb5 upcall (/run/rpc_pipefs/nfs/clnt56)
process_krb5_upcall: service is '*'
Full hostname for 'beale.cse.rl.ac.uk' is 'beale.cse.rl.ac.uk'
Full hostname for 'delves.cse.rl.ac.uk' is 'delves.cse.rl.ac.uk'
No key table entry found for DELVES$@CSE.RL.AC.UK while getting keytab entry for 'DELVES$@'
No key table entry found for <email address hidden> while getting keytab entry for 'root/delves.cse.rl.ac.uk@'
Success getting keytab entry for 'nfs/delves.cse.rl.ac.uk@'
Successfully obtained machine credentials for principal '<email address hidden>' stored in ccache 'FILE:/tmp/krb5ccmachine_CSE.RL.AC.UK'
INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_CSE.RL.AC.UK' are good until 1400526145
using FILE:/tmp/krb5ccmachine_CSE.RL.AC.UK as credentials cache for machine creds
using environment variable to select krb5 ccache FILE:/tmp/krb5ccmachine_CSE.RL.AC.UK
creating context using fsuid 0 (save_uid 0)
creating tcp client for server beale.cse.rl.ac.uk
DEBUG: port already set to 2049
creating context with server <email address hidden>
DEBUG: serialize_krb5_ctx: lucid version!
prepare_krb5_rfc4121_buffer: protocol 1
prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32
ERROR: GSS-API: error in gss_free_lucid_sec_context(): GSS_S_NO_CONTEXT (No context has been established) - Unknown error
WARN: failed to free lucid sec context
doing downcall lifetime_rec 35999
handling gssd upcall (/run/rpc_pipefs/nfs/clnt56)
handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 '
handling krb5 upcall (/run/rpc_pipefs/nfs/clnt56)
process_krb5_upcall: service is '<null>'
Full hostname for 'beale.cse.rl.ac.uk' is 'beale.cse.rl.ac.uk'
Full hostname for 'delves.cse.rl.ac.uk' is 'delves.cse.rl.ac.uk'
No key table entry found for DELVES$@CSE.RL.AC.UK while getting keytab entry for 'DELVES$@'
No key table entry found for <email address hidden> while getting keytab entry for 'root/delves.cse.rl.ac.uk@'
Success getting keytab entry for 'nfs/delves.cse.rl.ac.uk@'
INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_CSE.RL.AC.UK' are good until 1400526145
INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_CSE.RL.AC.UK' are good until 1400526145
using FILE:/tmp/krb5ccmachine_CSE.RL.AC.UK as credentials cache for machine creds
using environment variable to select krb5 ccache FILE:/tmp/krb5ccmachine_CSE.RL.AC.UK
creating context using fsuid 0 (save_uid 0)
creating tcp client for server beale.cse.rl.ac.uk
DEBUG: port already set to 2049
creating context with server <email address hidden>
DEBUG: serialize_krb5_ctx: lucid version!
prepare_krb5_rfc4121_buffer: protocol 1
prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32
ERROR: GSS-API: error in gss...

Status changed to 'Confirmed' because the bug affects multiple users.

I hit the same problem on Ubuntu 14.04
 uname -a
Linux yoda 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:30:00 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

handling gssd upcall (/run/rpc_pipefs/nfs/clnt12)
handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 '
handling krb5 upcall (/run/rpc_pipefs/nfs/clnt12)
process_krb5_upcall: service is '<null>'
Full hostname for 'eta.nat.c.sdu.dk' is 'eta.nat.c.sdu.dk'
Full hostname for 'yoda.nat.c.sdu.dk' is 'yoda.nat.c.sdu.dk'
Success getting keytab entry for 'YODA$@'
INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK' are good until 1404348760
INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK' are good until 1404348760
using FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK as credentials cache for machine creds
using environment variable to select krb5 ccache FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK
creating context using fsuid 0 (save_uid 0)
creating tcp client for server eta.nat.c.sdu.dk
DEBUG: port already set to 2049
creating context with server <email address hidden>
DEBUG: serialize_krb5_ctx: lucid version!
prepare_krb5_rfc4121_buffer: protocol 1
prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32
ERROR: GSS-API: error in gss_free_lucid_sec_context(): GSS_S_NO_CONTEXT (No context has been established) - Unknown error
WARN: failed to free lucid sec context
doing downcall lifetime_rec 36000
destroying client /run/rpc_pipefs/nfs/clnt13
Closing 'gssd' pipe for /run/rpc_pipefs/nfs/clnt12
destroying client /run/rpc_pipefs/nfs/clnt12

This problem still exists in 14.10.

I have also performed a full reinstalling of a 14.10 system, confirming that the bug still exists. It would be interesting to know if anyone has ever been able to perform a krb5p mount on Ubuntu since 13.10.

I can also confirm this bug and it is kernel related: Everything is working fine on the default 12.04 kernel (3.2), but once you upgrade to the trusty-backport kernel (3.14), this problem occurs.

This problem is still blocking for me (I had to migrate most machines to other distributions, but my workstation is still Ubuntu)

Linux tiger 4.2.0-27-generic #32-Ubuntu SMP Fri Jan 22 04:49:08 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

I find it quite remarkable that secure NFS has been completely broken for a few years now. Does no one actually use it?