Re: [nfsv4] more on gss authentication for callback

On Thu, Oct 30, 2003 at 02:42:51PM -0800, Mike Eisler wrote:
> > Will it work?  For the Kerberos V GSS-API mechanis, yes.  For
> > LIPKEY, no.
> 
> Why not? Say the client and server each have access to a passwd database
> kept in NIS or LDAP. Each NFS client and server has an entry in the 
> database.
> When the server makes a callback to the client, it supplies the server's
> "user" name and password over the SPKM-3 protected session. This requires
> each client to have an SPKM-3 private key and certificate. Which is why, 
> the NFSv4
> RFC3530 notes that since callbacks over LIPKEY require certificates on the 
> client
> and server, it is permissble for the server to issue the callback with pure 
> SPKM-3,
> and that the client SHOULD issue the SETCLIENTID with pure SPKM-3 (if wants 
> callbacks).

I did say LIPKEY, not SPKM-3.

As for SPKM-3, can this work without a client cert?  Would it be secure
without a client cert?  I think not.

> So it works, but it is not sensible to do uses LIPKEY for callbacks.

No, it's not sensible.

That's why we must purse the CCM-MIC approach.  And that means we need a
CB op for servers to ask clients to establish a GSS-API context in the
v4 channel for use with CCM-MIC in the CB channel.

Cheers,

Nico
-- 

_______________________________________________
nfsv4 mailing list
nfsv4@ietf.org
https://www1.ietf.org/mailman/listinfo/nfsv4