Re: [nfsv4] NFS over TLS for laptops

[Benjamin Kaduk <[e-mail]>]

On Thu, Dec 31, 2020 at 04:53:04PM +0000, Rick Macklem wrote:
> Chuck Lever wrote:
> > Ben Kaduk wrote:
> >>
> >> I suspect that we can find a compromise position, yes.
> >> The certificate still authenticates the client (not the user), and the
> >> client uses AUTH_SYS to claim what user is performing operations.  But the
> >> server uses the client's authenticated identity to restrict, by policy,
> >> what user identities the client is allowed to claim via AUTH_SYS.  In the
> >> degenerate case there is an otherName in the certificate that corresponds
> >> to a single user and the client can only claim that one user, which looks
> >> very similar to just authenticating the user, but we can say that the
> >> relevant policy logic is located in the server as part of its internal
> >> implementation choices.
> >
> >An NFS client might send legitimate operations as UID 0 too
> >(e.g., lease management). Those cannot be rejected. Perhaps
> >we need to specify that the client has to perform _all_
> >operations as the squashed user.
> Yes. I agree with this.
> My current implementation simply ignores the AUTH_SYS RPC
> credential when TLS squashing is enabled.

Hmm, that may not be as robust as you want, since a certificate is allowed
to have more than one SAN of any given type.  I think that if we do write
up something like this we should be sure to define behavior when multiple
names are present in the certificate.

-Ben