Re: Security negotiation

Trond Myklebust
2009-07-10T22:45:33Z

On Fri, 2009-07-10 at 17:38 -0500, Tom Haynes wrote:
> Chuck Lever wrote:
> > On Jul 10, 2009, at 4:55 PM, Tom Haynes wrote:
> >
> >> The second option would push AUTH_NONE to the end of the list, which
> >> corresponds to my thinking of it as a wild card.
> >
> > The problem with the server's auth list is that it is a list of _all_
> > flavors that the server supports.
>
> For us it is a list of flavors supported on that export.
>
> Our default export is basically sec=sys,rw.
>
> To get all of the flavors, the admin would have to configure them in.
>
> >
> > I was wondering when a server would not want to order the flavor list
> > by strongest to weakest. We have the use case of the kerberos 5
> > pseudoflavors: clients should probably use krb5 over krb5p by
> > default, as this provides good security without a lot of performance
> > overhead. But krb5p is stronger security than krb5.
>
> When they have different access lists.
>
> If they have the same access lists, then the server is free to order them...
>
> share -F nfs -o sec=sys:none:krb5,rw /foo
> share -F nfs -o sec=sys,ro,sec=krb5p,rw,root=@192.168.2.0,sec=krb5,rw /bar
>
> In the first, we don't care how the server presents them. In the second,
> the list would be: sys krb5p krb5.

Meaning that the client defaults to read-only access?

Trond