Re: NFSv3+Krb5 and mountd

["J. Bruce Fields" <bfields@fieldses.org>]

On Mon, Aug 30, 2004 at 02:41:28AM +0100, Paul Jakma wrote:
> On Tue, 24 Aug 2004, Per Olofsson wrote:
> 
> >And it works! I can tell that it uses Kerberos because I can write 
> >to the mounted fs if I have a ticket, but not without. The drawback 
> >is that I am now allowing AUTH_SYS mounting as well, which I want 
> >to avoid. Is this a bug in mountd? Is it difficult to fix?
> 
> It's a bug in mountd yes. J Bruce Fields had actually sent me a wee 
> patch to try fix it for me to test a good while ago, but I havnt 
> gotten back to looking at NFSv3+GSS since then:

This doesn't fix the problem Per Olofsson describes, which is that
unless you use nfsv4, there's no way to export to krb5 without also
exporting vi auth_sys.

Since mountd itself doesn't currently have rpcsec_gss support (and, on
the client side, neither does mount), MOUNT requests are going to use
auth_sys.  So mountd is going to decide whether to respond based on
their IP address.

It'd seem that the right solution is to add rpcsec_gss support to mount
and mountd, which shouldn't be a big project, so if you export only to
krb5 then you also answer krb5-protected mount requests.  I don't know
whether other clients will like that, though.

--Bruce Fields


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs