[Lustre-devel] Security configuration

[Lustre-devel] Security configuration

[Eric Barton]

Nathan,

We'd like to be able to describe a set of nodes and say that
as far as security is concerned, they are all equivalent - i.e. if
an MDT authorizes eeb at node1 to perform a certain action, then
eeb at nodex is implicitly authorized provided node1 and nodex are in
the same set.

Leaving aside for now, the question of how the sets are described
(they could be whole LNETs or whole Kerberos realms, or NID lists),
is the MGS the right place to stash this config?


    Cheers,
              Eric

[Lustre-devel] Security configuration

[Nicolas Williams]

On Tue, Feb 17, 2009 at 08:37:42PM +0000, Eric Barton wrote:
> We'd like to be able to describe a set of nodes and say that
> as far as security is concerned, they are all equivalent - i.e. if
> an MDT authorizes eeb at node1 to perform a certain action, then
> eeb at nodex is implicitly authorized provided node1 and nodex are in
> the same set.
> 
> Leaving aside for now, the question of how the sets are described
> (they could be whole LNETs or whole Kerberos realms, or NID lists),
> is the MGS the right place to stash this config?

As far as Kerberos V principal names go, then the name will be eeb at REALM
throughout.

As for what happens with identities on the wire (for GET/SETATTR), this
is where ID mapping comes in.  Here the configuration that matters will
be local to each client (what domain name to assert) and to the MDS
(what clients to trust).

Nico
-- 

[Lustre-devel] Security configuration

[Nathaniel Rutman]

Eric Barton wrote:
> Nathan,
>
> We'd like to be able to describe a set of nodes and say that
> as far as security is concerned, they are all equivalent - i.e. if
> an MDT authorizes eeb at node1 to perform a certain action, then
> eeb at nodex is implicitly authorized provided node1 and nodex are in
> the same set.
>
> Leaving aside for now, the question of how the sets are described
> (they could be whole LNETs or whole Kerberos realms, or NID lists),
> is the MGS the right place to stash this config?
>   
Yes, I think the MGS is the right place to stash any config.
FWIW we're pretty seriously thinking about removing all the distributed 
configuration we can (mkfs/tunefs.lustre settings and module parameters) 
and concentrating it all on the MGS node in a text-based config file.   
Exceptions would have to be made for the network setup, so that everyone 
could talk to the MGS -- so lnet networks and MGS nids would still have 
to be stored locally.