Re: [PATCH] Adding the nfs4_use_min_auth module parameter

[Steve Dickson <SteveD@redhat.com>]

Hey,

On 07/11/13 14:26, Myklebust, Trond wrote:
> On Thu, 2013-11-07 at 14:09 -0500, Steve Dickson wrote:
>> This new module parameter makes the v4 client
>> use the minimal authentication flavor (AUTH_UNIX)
>> when establishing NFSV4 state and doing the
>> pseudoroot lookup
>>
> 
> That looks very ad-hoc. Quite frankly, you can do the exact same thing
> already by simply blacklisting the rpcsec_gss_krb5 and/or auth_rpcgss
> modules.
I tried to keep a very small foot print... I'm not sure why that 
looks ad-hoc to you... 

If we blacklist those module(s) then we are disabling secure mounts
altogether... 

> 
> I think we should rather looks at adding a new mount option for
> specifying the security flavour to use when establishing basic NFSv4.x
> state, and then perhaps specifying the _default_ for that mount option
> using a module parameter.
The problem is everything is hard code in these two areas so having
a mount option would not work... 

The fact that -o sec=sys does not turn off the use of AUTH_GSS_KRB5x 
is simple wrong... IMHO... Not having way to override this behavior
is not a good thing... again... IMHO... 

Finally, Are there any servers out there today that support this type
of behavior? Requiring secure state establishment or secure 
pseudoroot lookups. 

Bruce, can we configure the Linux server to require this type security behavior? 
Can any server out there require these type of security behavior?  

If the answer is no, then we really need a way to disable this type
of behavior....

steved.