Re: NFSv3+Krb5 and mountd

["J. Bruce Fields" <bfields@fieldses.org>]

On Mon, Aug 30, 2004 at 01:45:33PM -0400, Trond Myklebust wrote:
> På må , 30/08/2004 klokka 13:17, skreiv J. Bruce Fields:
> 
> > I believe (can't find the right language now) that RFC2623 says it's OK
> > for the server to allow the client to do MOUNT requests and a few
> > filesystem requests (sufficient for statfs) without rpcsec_gss, even on
> > rpcsec_gss exports.  Our server and mountd currently do *not* do that.
> 
> Right. The RFC says that the NFS server should allow AUTH_SYS
> authenticated NFSPROC3_FSINFO (NFSv3) and NFSPROC_GETATTR+NFSPROC_STATFS
> (NFSv2) calls on the root filehandle (and *only* on the root
> filehandle).

And also, though it seems to be just implicit, it expects you to be able
to do MOUNT.

Since we specify the rpcsec_gss security flavor as the client in
/etc/exports, in the place of the ip address/network/whatever, this
means in practice we'd need to allow MOUNT from any ip address for a
filesystem that's exported to rpcsec_gss.  Which I suppose is OK, though
I don't understand why clients really want to do that.

> mountd should always support AUTH_SYS, so no changes required there
> (apart from the need to add the supported RPCSEC_GSS pseudoflavours to
> the "auth_flavors" list).
> As far as I know, nobody (not even Sun) has set up NLM to work with
> RPCSEC_GSS either.

Well, I suppose unauthenticated locks are a DOS at worse.  But the
lookup of the initial filehandle seems more security-critical to me.

--Bruce Fields


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs