(no subject)

From: Steven French (sfrench@us.ibm.com)
Date: Fri Oct 04 2002 - 12:32:22 EST


>On Oct 04, 2002 16:35 +0100, David Howells wrote:
>
> > NFSv4 does indeed require the full kerberos encryption stuff in the
> > kernel. The RFC specifies that krb5 support is a minimum requirement
> > will expect to have that in 2.6 (or 3.0 or whatever it's called these
> > days...)
>
> Might this be something I can make use of for my AFS filesystem too?

>We will also need kerberos for Lustre when we start implementing
>security. We will be using the GSSAPI for security, so basically
>the same as what AFS is using.
>
>Cheers, Andreas

The CIFS VFS (http://cifs.bkbits.net/linux-2.5) can get by with
just the kerberos service ticket encapsulation routines (negTokenInit,
negTokenTarg ala SPNEGO/GSSAPI) in kernel, and I have made a start
coding the cifs version of that since it will be a big benefit when
mounted to Samba 3.0 and this is almost required for decent Windows
2000 and .Net server security interoperability. It would be useful
to come up with a generalized way to request new & refresh
expired service tickets - perhaps from a pam/nss daemon something
like what the current version of the Winbind daemon does now. In the
interim, raw (i.e. non-SPNEGO encapsulated) NTLMSSP (or NTLM ala older
clients) is used in the CIFS VFS. Having a common call to get
at the kerberos tickets for a particular uid would be very helpful,
otherwise each remote filesystem might eventually code a different
IPC to a different user space mount or pam/nss helper
(e.g. Winbind for CIFS) to aquire a kerberos ticket that is opaque to
the particular filesystem.

Steve French
Senior Software Engineer
Linux Technology Center - IBM Austin
phone: 512-838-2294
email: sfrench@us.ibm.com

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Mon Oct 07 2002 - 22:00:46 EST