9.8.2. NFS security with AUTH_GSS
The release of NFSv4 brought a revolution to NFS security by mandating the implementation of RPCSEC_GSS and the Kerberos version 5 GSS-API mechanism. However, RPCSEC_GSS and the Kerberos mechanism are also available for all versions of NFS. In FIPS mode, only FIPS-approved algorithms can be used.
With the RPCSEC_GSS Kerberos mechanism, the server no longer depends on the client to correctly represent which user is accessing the file, as is the case with AUTH_SYS. Instead, it uses cryptography to authenticate users to the server, preventing a malicious client from impersonating a user without having that user's kerberos credentials.
Note
It is assumed that a Kerberos ticket-granting server (KDC) is installed and configured correctly, prior to configuring an NFSv4 server. Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC. For more information on Kerberos see Red Hat's Identity Management Guide.
To set up RPCSEC_GSS, use the following procedure:
Procedure 9.4. Set up RPCSEC_GSS
- Create
nfs/client.mydomain@MYREALMandnfs/server.mydomain@MYREALMprincipals. - Add the corresponding keys to keytabs for the client and server.
- On the server side, add
sec=krb5,krb5i,krb5pto the export. To continue allowing AUTH_SYS, addsec=sys,krb5,krb5i,krb5pinstead. - On the client side, add
sec=krb5(orsec=krb5i, orsec=krb5pdepending on the set up) to the mount options.
For more information, such as the difference between
krb5, krb5i, and krb5p, refer to the exports and nfs man pages or to Section 9.5, “Common NFS Mount Options”.
For more information on the
RPCSEC_GSS framework, including how rpc.svcgssd and rpc.gssd inter-operate, refer to http://www.citi.umich.edu/projects/nfsv4/gssd/.
9.8.2.1. NFS security with NFSv4
NFSv4 includes ACL support based on the Microsoft Windows NT model, not the POSIX model, because of the former's features and wide deployment.
Another important security feature of NFSv4 is the removal of the use of the
MOUNT protocol for mounting file systems. This protocol presented possible security holes because of the way that it processed file handles.
