From: "J. Bruce Fields" <bfields@fieldses.org>
To: Benjamin Coddington <bcodding@uvm.edu>
Cc: linux-nfs@vger.kernel.org
Subject: Re: multiple service identities for svcgssd
Date: Wed, 13 Jul 2011 13:35:34 -0400 [thread overview]
Message-ID: <20110713173534.GA11665@fieldses.org> (raw)
In-Reply-To: <3EA8A380-460C-4CDC-9591-7034D2E38D93@uvm.edu>
On Wed, Jul 13, 2011 at 12:03:03PM -0400, Benjamin Coddington wrote:
> I am working on a linux NFS cluster that requires a single svcgssd to establish contexts under multiple service names.
>
> In this scenario, svcgssd can be called with "-n" so that it acquires creds at context creation. After running this way I found svcgssd opens a file to the kerberos replay cache for every context/cred, eventually reaching ulimit. For a busy cluster with many different client-user pairs that becomes a problem. I am lost in the gss_krb5 code, but suspect that the kerberos code leaks credentials in this configuration.
>
> Ondrej Palkovsky submitted a patch to specify multiple identities and acquire creds up-front using multiples of "-h": http://marc.info/?l=linux-nfsv4&m=123685185324902&w=2
>
> I've updated that work to be current to nfs-utils-1.2.3 which solves our immediate problem, and it works well -- but running svcgssd with '-n' is still going to leak file handles to the replay cache. What's the best way to fix this? Can the created-on-the-fly cred can be re-used for subsequent contexts?
Sounds like a likely kerberos bug as well--may be use asking the
kerberos folks?
--b.
next prev parent reply other threads:[~2011-07-13 17:35 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-07-13 16:03 multiple service identities for svcgssd Benjamin Coddington
2011-07-13 17:10 ` Steve Dickson
2011-07-13 17:35 ` J. Bruce Fields [this message]
2011-07-20 12:56 ` Benjamin Coddington
2011-07-20 13:41 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110713173534.GA11665@fieldses.org \
--to=bfields@fieldses.org \
--cc=bcodding@uvm.edu \
--cc=linux-nfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.