Re: Security negotiation

[Tom Haynes <tdh-8AdZ+HgO7noAvxtiuMwx3w@public.gmane.org>]

Chuck Lever wrote:
> On Jul 10, 2009, at 4:55 PM, Tom Haynes wrote:
>
>> The second option would push AUTH_NONE to the end of the list, which
>> corresponds to my thinking of it as a wild card.
>
> The problem with the server's auth list is that it is a list of _all_ 
> flavors that the server supports.  

For us it is a list of flavors supported on that export.

Our default export is basically sec=sys,rw.

To get all of the flavors, the admin would have to configure them in.

>
> I was wondering when a server would not want to order the flavor list 
> by strongest to weakest.  We have the use case of the kerberos 5 
> pseudoflavors:  clients should probably use krb5 over krb5p by 
> default, as this provides good security without a lot of performance 
> overhead.  But krb5p is stronger security than krb5.

When they have different access lists.

If they have the same access lists, then the server is free to order them...

share -F nfs -o sec=sys:none:krb5,rw /foo
share -F nfs -o sec=sys,ro,sec=krb5p,rw,root=@192.168.2.0,sec=krb5,rw /bar

In the first, we don't care how the server presents them. In the second, 
the list would be: sys krb5p krb5.