From: "J. Bruce Fields" <bfields@fieldses.org>
To: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: Benjamin Bennett <ben@phys.psu.edu>, nfs@lists.sourceforge.net
Subject: Re: NFSv2/3 requiring RPC_AUTH_GSS
Date: Sat, 5 Mar 2005 01:45:37 -0500 [thread overview]
Message-ID: <20050305064537.GD4354@fieldses.org> (raw)
In-Reply-To: <1109963019.10173.14.camel@lade.trondhjem.org>
On Fri, Mar 04, 2005 at 11:03:39AM -0800, Trond Myklebust wrote:
> to den 03.03.2005 Klokka 17:54 (-0500) skreiv Benjamin Bennett:
> > v4 exports using gss/krb5 work from both FC2 and Solaris 10 clients.
> > However, for Solaris 8 I'm using v3 with gss/krb5.
> >
> > The problem I've run into with this, is that in order for the v3
> > client to mount (even using gss), it must be given sys/unix access too.
> > That pretty much rules out the nice sleep I could have gotten with all
> > clients using gss since they could just remount with auth_unix at will.
>
> Could you expand a bit on this? Is the problem that knfsd is failing to
> adhere to RFC2623?
> The latter says that the NFS server is supposed to accept AUTH_SYS as
> being valid for fsinfo(nfsv3) or fsstat+getattr(nfsv2) on the mount
> point. Is knfsd doing this?
No.
The immediate problem, though, is probably just that mountd isn't
reporting the security flavours correctly. This shouldn't be too hard
to fix for someone with the time and inclination.
(See
http://www.citi.umich.edu/projects/nfsv4/linux/nfs-utils-patches/1.0.7-1/nfs-utils-1.0.7-06-mountd_flavors.dif
for a hack that just always returns all the krb5 flavors in the mount
reply. All we need to do here is check the export table to figure out
which to report, and then we'll have a patch worth actually adding to
nfs-utils.)
--b.
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
NFS maillist - NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs
next prev parent reply other threads:[~2005-03-05 6:45 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-03-03 22:54 NFSv2/3 requiring RPC_AUTH_GSS Benjamin Bennett
2005-03-04 19:03 ` Trond Myklebust
2005-03-05 6:45 ` J. Bruce Fields [this message]
2005-03-05 9:47 ` Benjamin Bennett
2005-03-07 15:50 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20050305064537.GD4354@fieldses.org \
--to=bfields@fieldses.org \
--cc=ben@phys.psu.edu \
--cc=nfs@lists.sourceforge.net \
--cc=trond.myklebust@fys.uio.no \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.