Re: Security negotiation

Tom Haynes
2009-07-10T22:38:55Z

Chuck Lever wrote:
> On Jul 10, 2009, at 4:55 PM, Tom Haynes wrote:
>
>> The second option would push AUTH_NONE to the end of the list, which
>> corresponds to my thinking of it as a wild card.
>
> The problem with the server's auth list is that it is a list of _all_
> flavors that the server supports.

For us it is a list of flavors supported on that export.

Our default export is basically sec=sys,rw.

To get all of the flavors, the admin would have to configure them in.

>
> I was wondering when a server would not want to order the flavor list
> by strongest to weakest. We have the use case of the kerberos 5
> pseudoflavors: clients should probably use krb5 over krb5p by
> default, as this provides good security without a lot of performance
> overhead. But krb5p is stronger security than krb5.

When they have different access lists.

If they have the same access lists, then the server is free to order them...

share -F nfs -o sec=sys:none:krb5,rw /foo
share -F nfs -o sec=sys,ro,sec=krb5p,rw,root=@192.168.2.0,sec=krb5,rw /bar

In the first, we don't care how the server presents them. In the second,
the list would be: sys krb5p krb5.