From: Jaap <jwinius@umrk.nl>
To: linux-nfs@vger.kernel.org
Subject: Kerberos cfg for NFSv4
Date: Wed, 25 Sep 2013 15:21:54 +0000 (UTC) [thread overview]
Message-ID: <l1uv2i$jto$1@ger.gmane.org> (raw)
Hi folks,
My site already has a working Kerberos system that allows users to access
various services. To this end, all hosts already have a host/<hostname>
principal with a full set of cryptographic keys. On the servers, besides
the host keys in /etc/krb5.keytab, each Kerberized service has its own
keytab: some with a full set of keys and others with only one (= weak
crypto). Separate keytab files are maintained to prevent services from
reading the wrong keys.
Therefore, on each of my servers the single key for NFSv4 will also need
to be kept separate. With many Kerberized services, the Kerberos realm,
service name and keytab file location can be specified somewhere. With
others, the realm and service name are deduced from the contents of the
keytab, but almost always the keytab location must be set somewhere: in a
configuration file, or even with an environment variable. So how can this
be configured for NFSv4?
Thanks,
Jaap
reply other threads:[~2013-09-25 15:30 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='l1uv2i$jto$1@ger.gmane.org' \
--to=jwinius@umrk.nl \
--cc=linux-nfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).