Re: mount.nfs: access denied by server

[Peter Staubach <staubach@redhat.com>]

Tom Haynes wrote:
> J. Bruce Fields wrote:
>>
>>> Right now, we use AUTH_SYS if the mount command didn't specify a
>>> flavor, but the flavor we're going to use is always checked against
>>> the server's returned list.  You seem to be suggesting we should
>>> ignore the server's list entirely if sec= was specified...?
>>>     
>>
>> Yes.  I can't see what practical problems that would cause.
>>

Here, I am going to disagree.  The client should compare the
flavor specified with the list of authentication flavors
returned by the server and if the specific flavor isn't on
the list, then the mount attempt should be failed.

>> Also, while I hope this is the last bug in the mountd's flavor list
>> return, it isn't the first--only recently did we even start using real
>> information from the export instead of just faking something up.  So I
>> think it's safest to preserve the historical sec= behavior and give
>> users a way to override the negotiation, to cut down on bug reports of
>> mount failures on upgrade.
>>
>> --b.
>>   
> 
> 
> While this Linux behavior occasionally bites the OpenSolaris behavior, it
> really means we just have to guard against the client ignoring what we
> sent.
> I.e., if I say we only support krb5 and you try with AUTH_SYS, I should
> reject it.
> 

Which should happen correctly, right?

		ps

> Historical inertia is hard to overcome, but perhaps you could gradually
> ease your way into using the real data. :->
> -- 
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html