NFS security

NFS security

[Raghu R]

[-- Attachment #1: Type: text/plain, Size: 483 bytes --]

Hi guys,

I am a newbie at sourceforge and I need some help regarding a project topic
I would like to do provide GAA-API/kerberos support into NFS(I obviously
would not be able to provide all the features eg n/w with bridges etc), I
would like to get some feedback as to the scope of it, I am planning to do
it alone and have a time frame of about 2 months, I am very comfortable with
C/C++ and linux architecture.

Thanks a ton,

Raghu
Univ of California
Los Angeles.

[-- Attachment #2: Type: text/html, Size: 531 bytes --]

Re: NFS security

[Trond Myklebust]

to den 13.10.2005 Klokka 00:04 (-0700) skreiv Raghu R:
> Hi guys,
> 
> I am a newbie at sourceforge and I need some help regarding a project
> topic I would like to do provide GAA-API/kerberos support into NFS(I
> obviously would not be able to provide all the features eg n/w with
> bridges etc), I would like to get some feedback as to the scope of it,
> I am planning to do it alone and have a time frame of about 2 months,
> I am very comfortable with C/C++ and linux architecture.

Since we already have GSS_API support, I assume that your project would
mainly be to add all the support for the EACL stuff?
Could you please outline how you propose to implement this? I'm not
aware of any GAA-API implementations for RPC or NFS.

Cheers,
  Trond



-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: NFS security

[Raghu R]

[-- Attachment #1: Type: text/plain, Size: 1266 bytes --]

Hi,

I am sorry I mistyped that I had meant GSS-API and not GAA-API, I actually
proposed to the professor today he says the scope of the project is huge for
a single person for a perid of abt 2 months, the professor has suggested
something simpler managable like a fix or something tp add to security to
NFS, can you suggest some?

Thanks.
Raghu
Univ of California
Los Angeles, LA

On 10/13/05, Trond Myklebust <trond.myklebust@fys.uio.no> wrote:
>
> to den 13.10.2005 Klokka 00:04 (-0700) skreiv Raghu R:
> > Hi guys,
> >
> > I am a newbie at sourceforge and I need some help regarding a project
> > topic I would like to do provide GAA-API/kerberos support into NFS(I
> > obviously would not be able to provide all the features eg n/w with
> > bridges etc), I would like to get some feedback as to the scope of it,
> > I am planning to do it alone and have a time frame of about 2 months,
> > I am very comfortable with C/C++ and linux architecture.
>
> Since we already have GSS_API support, I assume that your project would
> mainly be to add all the support for the EACL stuff?
> Could you please outline how you propose to implement this? I'm not
> aware of any GAA-API implementations for RPC or NFS.
>
> Cheers,
> Trond
>
>

[-- Attachment #2: Type: text/html, Size: 1619 bytes --]

Re: NFS security

[Trond Myklebust]

fr den 14.10.2005 Klokka 07:41 (-0700) skreiv Raghu R:
> Hi,
> 
> I am sorry I mistyped that I had meant GSS-API and not GAA-API, I
> actually proposed to the professor today he says the scope of the
> project is huge for a single person for a perid of abt 2 months, the
> professor has suggested something simpler managable like a fix or
> something tp add to security to NFS, can you suggest some?

I'm not sure I understand you. We already have GSS-API support for Linux
NFS on both client and server in linux-2.6.x. RPCSEC_GSS _is_ GSS-API
for SunRPC based protocols.

Cheers,
  Trond



-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: NFS security

[J. Bruce Fields]

On Fri, Oct 14, 2005 at 07:41:26AM -0700, Raghu R wrote:
> I am sorry I mistyped that I had meant GSS-API and not GAA-API, I actually
> proposed to the professor today he says the scope of the project is huge for
> a single person for a perid of abt 2 months,

Probably so.  And it's already been done, for the most part.

> the professor has suggested something simpler managable like a fix or
> something tp add to security to NFS, can you suggest some?

A couple rpcsec_gss loose ends that need doing:

	* Fix mountd to enable auth_unix mount requests for krb5
	  mounts--needed by people doing rpcsec_gss over NFSv2/v3.
	  See http://bugzilla.linux-nfs.org/show_bug.cgi?id=57
	* Add 3DES, AES, etc. support.
	* Perform experiments to measure the rpcsec_gss performance
	  overhead.

And there are probably plenty of others depending on interest.

Make sure you let the list at nfsv4@linux-nfs.org know what you're
doing.

--b.


-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs