Re: NFSv2/3 requiring RPC_AUTH_GSS

["J. Bruce Fields" <bfields@fieldses.org>]

On Sat, Mar 05, 2005 at 04:47:52AM -0500, Benjamin Bennett wrote:
> The problem I saw (can't require gss for v3 access) seems to be the
> result of two things:
> 
>   A) mountd needs to see the v3 host in exports (or it will return
> unknown host). So even though we just want to use gss, we need another
> export (auth_unix) to satisfy this.

Oh, right.

>   I wrote a little code to unconditionally send back a successful mount
> response with filehandle and included gss flavors. This led to the
> second problem:
> 
>   B) knfsd also validates host, so we again need the same auth_unix
> export as in A.

I'm not sure what you mean by "knfsd also validates host".  I think the
client mount program sends a NULL rpc call to nfsd, is that what you're
talking about?

>   The most simple work-around I could think of was making the auth_unix
> export ro, all_squash. But that still allows auth_unix anyone to mount
> and be nobody ;-)
> 
>   Whether a client is going to use gss for nfs transactions isn't
> necessarily known at mount time, so we can't just have mountd ignore
> hostnames when gss is going to be used.

Well, I suppose we could require mount to contact mountd using gss.
That seems much more sensible to me than what rfc2623 recommends.  Maybe
I'm missing some obvious problem.

--b.


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs