Re: Switching identity using kinit/kdestroy for NFSv4 mounts doesn't work

2015-03-13 Thread Simo Sorce
On Fri, 2015-03-13 at 14:05 +, Brandon Allbery wrote: > On Fri, 2015-03-13 at 14:55 +0100, Robert Wehn wrote: > > There is a bug report/suggested patch which seems to make it possible > > but never seemed to get into the kernel: > > http://www.spinics.net/lists/linux-nfs/msg34236.html > > > >

Re: Switching identity using kinit/kdestroy for NFSv4 mounts doesn't work

2015-03-13 Thread Benjamin Kaduk
On Fri, 13 Mar 2015, Robert Wehn wrote: > - - klist > -> TGT for jane@REALM > BUT! > -> localuser can still access alice's files > -> localuser can never access jane's files > -> no new NFS service ticket fetched or needed till the end > of the ticket lifetime > > What doesn't help: >

Re: Switching identity using kinit/kdestroy for NFSv4 mounts doesn't work

2015-03-13 Thread Brandon Allbery
On Fri, 2015-03-13 at 14:55 +0100, Robert Wehn wrote: > There is a bug report/suggested patch which seems to make it possible > but never seemed to get into the kernel: > http://www.spinics.net/lists/linux-nfs/msg34236.html > > What is your opinion to this behavior? > Do you think this is reasonab

Switching identity using kinit/kdestroy for NFSv4 mounts doesn't work

2015-03-13 Thread Robert Wehn
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, we mount Linux home directories from a NFSv4 server authenticated/authorized via MIT Kerberos/OpenLdap. The underlying file system (GPFS) is NFSv4 ACL aware. Now we would like to expose the data to the user for homeUse/syncing using Webdav or

Re: Smart lock protocol

2015-03-13 Thread Rick van Rein
Hi Simon, > First off, Thanks for all your ideas! Your idea inspired me. I’m assuming this is a hobby project, as you probably gathered. > The only problems with Kerberos are > 1) it requires the user to have internet on his phone There are many ways of bypassing that… - you could use Blueto

Re: Smart lock protocol

2015-03-13 Thread Simon Peeters
Hi, First off, Thanks for all your ideas! The only problems with Kerberos are 1) it requires the user to have internet on his phone 2) the phone must contact the server and obtain tickets every time it wants to lock/unlock the door which adds delay (not sure how much). A solution would be to have

Re: Help with kerberos+nfs V4 on a webserver using suexec and suphp

2015-03-13 Thread Robert Wehn
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Rainer, we are working on a similar setup with a webserver mounting a filespace via NFSv4 and therefore started a little intern discussion (file-system guys with web-guys), how we think the issue could be solved. The following is what our analysis