On Thu, Sep 20, 2001 at 04:37:42PM +0200, Vladimir Beker wrote:
> Hello,
> Doing the NFS server, we would like to provide RPC_GSSAPI for better
> security.
It's called RPCSEC_GSS
> I've got all information (I hope) that may be reached from RFCs. There are
> still several things, that I miss in entire puzzle.
> 1) RPC_GSSAPI allows multiple pseudo-flavors (depending on mechanisms in
> use). Which of them are actually in use and have to be supported? I mean
> working with clients from Microsoft, Linux and major UNIXes (Sun?). Is
> Kerberos enough?
Sun supports Kerberos and a NIS+ Diffie-Hellman -based system. You can
add/write 3rd party flavors, but I know of none.
> 2) What forces the client computer to use stronger security rather than
> AUTH_UNIX over RPC. I have the total control of what's going on the server,
> but plan no changes in configuration of clients.
The client has to be able to support RPCSEC_GSS and a GSS mechanism in
common with the server. The server forces the use of RPCSEC_GSS -- I
think -- look at the MOUNT protocol -- either that or the client must
know ahead of time that RPCSEC_GSS is needed for a particular NFS
share. I forget this detail...
> 3) How can I support both AUTH_UNIX and Kerberos over AUTH_RPCGSS in the
> single installation. The question is not about security leaks but rather
> about user identification: in case of AUTH_UNIX I get user ID/group ID with
> RPC message. In case of Kerberos - I get ticket. How should I support the
> single namespace of users for these 2 methods.
You can't use AUTH_UNIX as a flavor of RPCSEC_GSS.
The server maps client kerberos principal names to Unix accounts
(uid/gids). See gssd(1M) and gsscred(1M).
> 4) Where can I find good samples for using GSS for such kind of work?
Sun's TI-RPC [open] source includes an implementation of RPCSEC_GSS,
though it does not include any implementation of any RPCSEC_GSS
flavors.
> 5) Are sources for appropriated GSS implementation available somewhere and
> under which conditions?
Check out Sun's sites. Also, there's a Linux implementation. Google and
other search sites are your friends.
> Thanks in advance
> Vladimir
Nico
--
-DISCLAIMER: an automatically appended disclaimer may follow. By posting-
-to a public e-mail mailing list I hereby grant permission to distribute-
-and copy this message.-
Visit our website at http://www.ubswarburg.com
This message contains confidential information and is intended only
for the individual named. If you are not the named addressee you
should not disseminate, distribute or copy this e-mail. Please
notify the sender immediately by e-mail if you have received this
e-mail by mistake and delete this e-mail from your system.
E-mail transmission cannot be guaranteed to be secure or error-free
as information could be intercepted, corrupted, lost, destroyed,
arrive late or incomplete, or contain viruses. The sender therefore
does not accept liability for any errors or omissions in the contents
of this message which arise as a result of e-mail transmission. If
verification is required please request a hard-copy version. This
message is provided for informational purposes and should not be
construed as a solicitation or offer to buy or sell any securities or
related financial instruments.
