Re: [nfsv4] NFS over TLS for laptops

On Sat, Dec 12, 2020, 7:02 PM Rick Macklem <rmacklem@uoguelph.ca> wrote:

> Hi,
>
> David Noveck emailed me w.r.t talking about this at a future meeting.
> This sounds rather scary to me,

 Not sure why we you think we are so scary.

sooooo I figured I'd post here and then, if
> others want me to, I can try to attend a "virtual meeting".
>

I'd like to have your proposal discussed, but, if you don't want to
actually present, it is ok.
I just need you to decide in the next week so I can put together an agenda.

First off, the disclaimer that I am neither a security guy nor TLS guy.
>

That's not a problem. A security guy would just tell us we suck.  A TLS guy
is going to be attending tls meetings, but will be needed to review your
proposal if the working group decides to pursue it.

>
> The case I was trying to address was mobile device (aka laptop)
> mounts to an NFS server using TLS. These devices are assumed to
> have two properties:
> - Used by a single user.
> - Connecting to the Internet from anywhere (ie. no fixed IP nor
>    DNS name).
>

Secure use on the internet was an official goal of RFC 3530 published
4/2003.  Sigh!

> Typical filtering at the NFS server via client IP address obviously cannot
> work, so
> what can be done?
>

The old answer was RPCSECGSS but we seem to be stuck with AUTH_SYS which is
one reason security people tell us we suck.

>
The working group has to decide how to retain AUTH_SYS, with acceptable
security. As I see it your proposal has a possible role in that

>

> Now, for the part that might be considered a violation of the "soon
> to be an RFC" draft.
>

Unless you are quoting someone else, you are misquoting me.  I never said
"soon". Rpc-tls is in rfc-editor state and so is an rfc-to-be.

Whether your proposal is in conflict with rpc-tls should be first addressed
with its editor

>
>
>
>
>
>
> _______________________________________________
> nfsv4 mailing list
> nfsv4@ietf.org
> https://www.ietf.org/mailman/listinfo/nfsv4
>