Re: [secdir] [nfsv4] Secdir early review of draft-ietf-nfsv4-rpc-tls-03

[David Noveck <[e-mail]>]

> Indeed, they are permitted.

Otherwise there would be no point in writing this document.

> All legacy servers will take this form,

What form?

> and of course,

????

> if no certificate material is provided to a TLS-capable
> NFS server, it will act as if RPC-on-TLS is recognized but not
> supported.

i don't think this right.   I think encryption without authentication
is of real value if you have other ways of authenticating.   I think
it would be reasonable for server to be configured so as not to
accept use of auth_SYs fro unauthenticated clients.

> "Encouraged" is a bit strong, however.

It's weaker than "recommended", "required", "RECOMMENDED",
and "REQUIRED".   If you don't like those, you are gpoing to have
to say something beyond "OPTIONAL".   Even if there is no
RFC21119, you could describe 9normatively) describe use of this
as "valuable", "highly desirable".

> I think if we /encourage/ a
> behavior, it would be to encourage the use of RPC-on-TLS where it is
> practical.

We certainly don't want to encorage use of this where it is impractical.
If we did, nobody would listen to us, anyway.

Perhaps we can address this non-normatively by accurately describing
the consequences of not using this.   The document on NFSv4 security
will probably take that approach.

On Thu, Oct 24, 2019 at 9:14 AM Chuck Lever <[e-mail]> wrote:

>
> > On Oct 23, 2019, at 5:13 PM, Rick Macklem <[e-mail]> wrote:
> >
> > I'll admit I haven't read the most recent draft and haven't looked at it
> > in detail. However, my impression is that the reviewer might be more
> > comfortable if the draft makes it clear that "rpc-tls only" servers will
> > not only be permitted, but encouraged.
>
> Indeed, they are permitted. All legacy servers will take this form,
> and of course, if no certificate material is provided to a TLS-capable
> NFS server, it will act as if RPC-on-TLS is recognized but not
> supported.
>
> "Encouraged" is a bit strong, however. I think if we /encourage/ a
> behavior, it would be to encourage the use of RPC-on-TLS where it is
> practical.
>
>
> > (I don't see a "http" vs "https" distinction, but extant NFSv4 servers
> that
> > I am familiar with can be configured to only allow clients that use
> > RPCSEC_GSS and I would expect that rpc-tls enabled servers could be
> > configured the same way.)
> >
> > As an aside, I do plan on implementing this in Winter 2020, rick
>
> Thanks Rick!
>
> --
> Chuck Lever
>
>
>
>