From: Orion Poplawski <orion@cora.nwra.com>
To: Jim Rees <rees@umich.edu>
Cc: "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>
Subject: Re: Any way to allow setuid daemon to access krb5 automounted nfs directories?
Date: Tue, 25 Sep 2012 14:11:19 -0600 [thread overview]
Message-ID: <50620FE7.9020103@cora.nwra.com> (raw)
In-Reply-To: <20120925175025.GA8020@umich.edu>
On 09/25/2012 11:50 AM, Jim Rees wrote:
> Orion Poplawski wrote:
>
> Is there any way to allow setuid daemon to access krb5 automounted
> nfs directories? Specifically I'm looking to run spamassassin's
> spamd on a remote server and access user's home directories via krb5
> nfs4. spamd changes user to the user receiving the email being
> processes and needs to modify files in the user's home directory.
> Is there any reasonably secure way to give this daemon the ability
> to do this? Any way to tell rpc.gssd to use a specific credential
> cache for this type of access rather than the default for that
> effective uid?
>
> You don't want to give spamd the user's credentials. You want to acl the
> user's files so that spamd can do what it wants. Spamd will need its own
> krb5 principal.
Hmm, okay, I may be able to run spamd in non-setuid mode and get it to work.
Thanks.
> But I hope you're not planning to deliver mail over nfs. I think that would
> be a mistake.
>
Oh no, but my mail host at the moment is woefully under-powered so I've moved
spam scanning off of it.
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA, Boulder Office FAX: 303-415-9702
3380 Mitchell Lane orion@nwra.com
Boulder, CO 80301 http://www.nwra.com
next prev parent reply other threads:[~2012-09-25 20:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-25 16:44 Any way to allow setuid daemon to access krb5 automounted nfs directories? Orion Poplawski
2012-09-25 17:50 ` Jim Rees
2012-09-25 20:11 ` Orion Poplawski [this message]
2012-09-25 20:52 ` Myklebust, Trond
2012-09-26 11:45 ` Jim Rees
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50620FE7.9020103@cora.nwra.com \
--to=orion@cora.nwra.com \
--cc=linux-nfs@vger.kernel.org \
--cc=rees@umich.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.