Re: [PATCH 0/3] Various gssd fixes including machine-credential issue.

[NeilBrown <neilb@suse.de>]

[-- Attachment #1: Type: text/plain, Size: 2766 bytes --]

On Sun, 2 Jun 2013 22:45:16 -0400 Chuck Lever <chuck.lever@oracle.com> wrote:

> 
> On Jun 2, 2013, at 10:23 PM, NeilBrown <neilb@suse.de> wrote:
> 
> > On Sun, 2 Jun 2013 22:01:50 -0400 Chuck Lever <chuck.lever@oracle.com> wrote:
> > 
> >> 
> >> On Jun 2, 2013, at 9:00 PM, Neil Brown <neilb@suse.de> wrote:
> >> 
> >>> As you probably know, since 3.7 (I think) Linux NFS has explicitly
> >>> asked for machine credentials for certain requests rather than asking
> >>> for root credentials as is previously did.
> >>> This causes a regression for people who don't have any machine
> >>> credentials configured and use "gssd -n".
> >>> 
> >>> I gather this was discussed on the mailing list earlier this year but
> >>> not resolved.
> >> 
> >> It's resolved in 3.10-rc.
> >> 
> >> The kernel will attempt to use krb5i for lease management operations.  If that fails because there is no keytab available, it falls back to using AUTH_SYS.
> > 
> > And if the server refuses to accept AUTH_SYS?
> > 
> > I guess this is commit 79d852bf5e7691dc7 ??
> 
> That's one of the subsequent bug fixes.  The initial change is commit 4edaa308.
> 
> > It seems to say that the server should always accept AUTH_SYS ... is that right?
> 
> If we ever find a server implementation that does not support either Kerberos or AUTH_SYS, we can add another step to the negotiation.
> 
> So far, despite RFC 3530 not requiring AUTH_SYS support on NFSv4 servers, I haven't found an implementation that does not support AUTH_SYS.  We have found one (FreeBSD) that does not support AUTH_NONE.  We do know that some servers allow administrators to control what security flavors are allowed for lease management.
> 
> > That commit isn't tagged for -stable.
> > So do we still need to make it work for 3.7,3.8,3.9 users?
> 
> There are several commits that would need to be back-ported, starting with commit 4edaa308.  I am not certain they would apply cleanly to 3.[789], but a backport should not be difficult.
> 
> This change also requires that now gssd must be running on the client.  Otherwise without gssd a sec=sys mount hangs for a bit waiting for the upcall to time out (since the client will attempt to use krb5i for lease management operations).  Trond and Bruce have been discussing a change to address that.

Thanks for the explanation.  That all looks rather painful to back-port
though, especially as some of it isn't even written yet :-)
I think I'll stick with my "-N" option for openSUSE for now.

Do you think that supporting -N (or similar) so that the admin can ask for
root credentials to be used for SETCLIENTID requests is reasonable? i.e. what
do you think of my patch going in to nfs-utils anyway?

Thanks,
NeilBrown

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 828 bytes --]