From: "Myklebust, Trond" <Trond.Myklebust@netapp.com>
To: "J. Bruce Fields" <bfields@fieldses.org>
Cc: NeilBrown <neilb@suse.de>,
Charles Edward Lever <chuck.lever@oracle.com>,
Steve Dickson <SteveD@redhat.com>,
Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Subject: Re: [PATCH] Adding the nfs4_secure_mounts bool
Date: Wed, 13 Nov 2013 04:15:26 +0000 [thread overview]
Message-ID: <1384316126.15992.33.camel@leira.trondhjem.org> (raw)
In-Reply-To: <20131113034636.GA32628@fieldses.org>
On Tue, 2013-11-12 at 22:46 -0500, J. Bruce Fields wrote:
> OK, but it still seems dumb to even attempt the reverse lookup: the
> lookup probably isn't secure, and the mount commandline should have a
> name that we can match to a krb5 principal without needing any other
> lookups.
>
> So I'd think reasonable behavior in this case would be to just try the
> IP address on the chance there's actually an nfs/x.y.z.w@REALM
> principal. (Or just fail outright if kerberos doesn't allow principals
> that look like that.)
Looking through the krb5.conf manpage etc it looks as if a lot of this
functionality should be covered by the krb protocol itself without us
needing to do explicit reverse lookups in rpc.gssd. I'm thinking of the
'canonicalize' and 'rdns' options, for instance. Am I wrong?
--
Trond Myklebust
Linux NFS client maintainer
NetApp
Trond.Myklebust@netapp.com
www.netapp.com
next prev parent reply other threads:[~2013-11-13 4:15 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-11-09 22:47 [PATCH] Adding the nfs4_secure_mounts bool Steve Dickson
2013-11-09 23:12 ` Myklebust, Trond
2013-11-10 22:31 ` Steve Dickson
2013-11-10 22:45 ` Myklebust, Trond
2013-11-11 13:00 ` Steve Dickson
2013-11-11 18:06 ` Steve Dickson
2013-11-11 18:25 ` Myklebust, Trond
2013-11-11 18:43 ` Steve Dickson
2013-11-11 18:53 ` Myklebust, Trond
2013-11-11 19:05 ` Steve Dickson
2013-11-11 19:21 ` Myklebust, Trond
2013-11-11 18:30 ` Chuck Lever
2013-11-11 18:59 ` Steve Dickson
2013-11-11 20:33 ` Chuck Lever
2013-11-11 21:13 ` Steve Dickson
2013-11-11 21:47 ` Chuck Lever
2013-11-11 23:00 ` Steve Dickson
2013-11-12 16:09 ` Chuck Lever
2013-11-12 16:24 ` Steve Dickson
2013-11-12 16:46 ` Chuck Lever
2013-11-12 16:52 ` Steve Dickson
2013-11-12 16:10 ` J. Bruce Fields
2013-11-12 5:11 ` NeilBrown
2013-11-12 5:29 ` Myklebust, Trond
2013-11-12 16:16 ` J. Bruce Fields
2013-11-13 0:23 ` NeilBrown
2013-11-13 0:30 ` Myklebust, Trond
2013-11-13 1:13 ` NeilBrown
2013-11-13 1:26 ` Myklebust, Trond
2013-11-14 1:05 ` NeilBrown
2013-11-14 1:07 ` [PATCH - nfs-utils] gssd: always reply to rpc-pipe requests from kernel NeilBrown
2013-11-14 13:34 ` Jeff Layton
2013-11-20 21:21 ` Steve Dickson
2013-11-13 3:46 ` [PATCH] Adding the nfs4_secure_mounts bool J. Bruce Fields
2013-11-13 4:15 ` Myklebust, Trond [this message]
2013-11-14 1:10 ` NeilBrown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1384316126.15992.33.camel@leira.trondhjem.org \
--to=trond.myklebust@netapp.com \
--cc=SteveD@redhat.com \
--cc=bfields@fieldses.org \
--cc=chuck.lever@oracle.com \
--cc=linux-nfs@vger.kernel.org \
--cc=neilb@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.