Re: NFSv3+Krb5 and mountd

[Per Olofsson <pelle@dsv.su.se>]

J. Bruce Fields:
> I think that adding rpcsec_gss support to the userland utilities, and
> making it easy for people to distribute keytabs to their clients, is the
> better long-term solution than enabling RFC2623's workarounds.  But
> maybe too many clients already expect to be able to mount with auth_sys
> only.

I think there are some benefits with allowing mounting without
requiring a keytab. For example, I'd like to give my users the ability
to mount their home directories from outside of the department
(e.g. their home computers). I don't think it would be practical to
distribute keytabs to all of them, and in many cases it simply doesn't
work (dynamic IPs, NAT, etc.).

It would also be nice to be able to fallback to something similar to
auth_sys with all_squash in case there's no ticket/keytab present for
the current user. This is roughly how AFS behaves. It's not too
important, though.

-- 
Pelle


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs