Re: [nfsv4] NFS over TLS for laptops

David Noveck wrote:
>On Sat, Dec 12, 2020, 7:02 PM Rick Macklem  wrote:
>>Hi,
>>
>>David Noveck emailed me w.r.t talking about this at a future meeting.
>>This sounds rather scary to me,
>>
> Not sure why we you think we are so scary.
Heh, heh. It's not you guys that are scary, it's the technology that's scary.
In January, I'll probably be living in a room with flakey wifi.
I don't currently have a microphone (just earphones). Buying such a thing
may be somewhat challenging, given my location and the pandemic.
The last order I did with Amazon took a month and the nearest Walmart
is 200km away, but I can get that done, if I need to.
I've also never used any of these systems like Zoom.
(I really do still use "ed" as my main text editor and I hate using my phone.;-)
I'm worse at tech stuff than any teenager...

So, I'll wait a week and see what others might say about this.

I'll also note I didn't exactly intend this as a proposal, but I suppose there
is a thin line between what I am testing and proposing it for others.

rick

sooooo I figured I'd post here and then, if
others want me to, I can try to attend a "virtual meeting".

I'd like to have your proposal discussed, but, if you don't want to actually present, it is ok.
I just need you to decide in the next week so I can put together an agenda.

First off, the disclaimer that I am neither a security guy nor TLS guy.

That's not a problem. A security guy would just tell us we suck.  A TLS guy is going to be attending tls meetings, but will be needed to review your proposal if the working group decides to pursue it.

The case I was trying to address was mobile device (aka laptop)
mounts to an NFS server using TLS. These devices are assumed to
have two properties:
- Used by a single user.
- Connecting to the Internet from anywhere (ie. no fixed IP nor
   DNS name).

Secure use on the internet was an official goal of RFC 3530 published 4/2003.  Sigh!

Typical filtering at the NFS server via client IP address obviously cannot work, so
what can be done?

The old answer was RPCSECGSS but we seem to be stuck with AUTH_SYS which is one reason security people tell us we suck.

The working group has to decide how to retain AUTH_SYS, with acceptable security. As I see it your proposal has a possible role in that

Now, for the part that might be considered a violation of the "soon
to be an RFC" draft.

Unless you are quoting someone else, you are misquoting me.  I never said "soon". Rpc-tls is in rfc-editor state and so is an rfc-to-be.

Whether your proposal is in conflict with rpc-tls should be first addressed with its editor

_______________________________________________
nfsv4 mailing list
nfsv4@ietf.org<mailto:nfsv4@ietf.org>
https://www.ietf.org/mailman/listinfo/nfsv4