Messages in this thread | | | Subject | | From | "Steven French" <> | Date | Fri, 4 Oct 2002 12:32:22 -0500 |
| |
>On Oct 04, 2002 16:35 +0100, David Howells wrote: > > > NFSv4 does indeed require the full kerberos encryption stuff in the > > kernel. The RFC specifies that krb5 support is a minimum requirement > > will expect to have that in 2.6 (or 3.0 or whatever it's called these > > days...) > > Might this be something I can make use of for my AFS filesystem too?
>We will also need kerberos for Lustre when we start implementing >security. We will be using the GSSAPI for security, so basically >the same as what AFS is using. > >Cheers, Andreas
The CIFS VFS (http://cifs.bkbits.net/linux-2.5) can get by with just the kerberos service ticket encapsulation routines (negTokenInit, negTokenTarg ala SPNEGO/GSSAPI) in kernel, and I have made a start coding the cifs version of that since it will be a big benefit when mounted to Samba 3.0 and this is almost required for decent Windows 2000 and .Net server security interoperability. It would be useful to come up with a generalized way to request new & refresh expired service tickets - perhaps from a pam/nss daemon something like what the current version of the Winbind daemon does now. In the interim, raw (i.e. non-SPNEGO encapsulated) NTLMSSP (or NTLM ala older clients) is used in the CIFS VFS. Having a common call to get at the kerberos tickets for a particular uid would be very helpful, otherwise each remote filesystem might eventually code a different IPC to a different user space mount or pam/nss helper (e.g. Winbind for CIFS) to aquire a kerberos ticket that is opaque to the particular filesystem.
Steve French Senior Software Engineer Linux Technology Center - IBM Austin phone: 512-838-2294 email: sfrench@us.ibm.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |