Re: [nfsv4] NFSv4 Persistent Mounts and Authentication

[Benjamin Kaduk <[e-mail]>]

On Tue, Jun 20, 2017 at 07:36:59AM -0500, Lesley Kimmel wrote:
> All;
> 
> Forgive me if this question is somewhat incorrect as we are just getting
> started with NFSv4.
> 
> It seems that [kerberized] NFSv4 is well suited for things like home
> directories that can be authenticated and mounted when a user accesses the
> system. However, we are considering a few issues and are wondering what the
> recommended configuration is:
> 
> 1) Users execute a long running job (assume longer than the Kerberos ticket
> lifetime) and log out. How can the Kerberos ticket automatically be renewed
> so that these types of jobs continue to run?

An impromptu option is to use the k5start utility
(https://www.eyrie.org/~eagle/software/kstart/k5start.html) to wrap
the long-running job, which does involve having k5start store the
plaintext user password in memory for the duration of the job or
turning the password into a keytab file, neither of which are
super-great from asecurity point of view.

A somewhat better option is to issue dedicated additional kerberos
principals to users running long jobs, perhaps as
user/longjobs@REALM or similar.  Those new principals can be granted
access to write to just the needed portion of secure storage and do
not have other privileges granted to the regular user@REALM
principals, so there is less risk in leaving the credentials around
with the long-running job.

> 2) How would CRON jobs executing scripts from an NFS share gain a Kerberos
> ticket to be able to perform these actions?

Generally the simplest way is to give whatever is running cron
its own principal (e.g., host/a.host.running.cron@REALM) and grant
the necessary filesystem permissions to that additional principal.

-Ben