Re: [nfsv4] Path forward for flex-files

[Rick Macklem <[e-mail]>]

Benjamin Kaduk wrote:
>On Tue, Aug 08, 2017 at 12:20:26AM +0000, Rick Macklem wrote:
>> Benjamin Kaduk wrote:
>> [stuff snipped]
>> > The solution space looks rather different whether the synthetic principals
>> > are actually being created/deleted on the KDC or synthesized using the
>> > data server's keytab.
>> I'm not sure what you are thinking of w.r.t. synthesized using the data server's keytab,
>> but I am curious?
>
>A service ticket is "just" some DER-encoded data encrypted+MAC'd in a symmetric
>key shared between the KDC and the service principal (in the simple case).
>When the service application receives a service ticket along with the client's
>request, the service knows that the ticket came from the KDC because the
>MAC verifies, generating/verifying the MAC requires that symmetric shared
>key, and the service knows that it didn't generate the ticket itself.
>Note the logical leap at the end -- it's assumed from the KDC because the
>KDC is the only other party that's supposed to have the key material.
>But really, anyone with the right key can encode the right data and encrypt+MAC
>it using that key -- this allows one to print a ticket to onesself that
>claims to be for a client principal that does not even exist in the
>KDC's database.
>
>We use this "ticket printing" technique in AFS for server-to-server
>communications, and it's exposed to some maintenance tools as well.
Ok, so a simple way of doing this would be to...
- Create the synthetic principals on the KDC and acquire keytab entries for them.
- Move the keytab entries to a file in the MDS.
Then the MDS could generate a service ticket for the synthetic principal by acquiring
a TGT for the synthetic principal and then letting gss_init_sec_context() do the rest?
(I think you can also do this for the principal "root@MYREALM" and the MDS can
 use that to gain "root" access to the DS for at least some Kerberized NFS servers.
 I believe I did this "root" trick in FreeBSD and it worked, although I wouldn't
 recommend it from a security point of view.)

Thanks for the info, rick