9.8.2. NFS security with AUTH_GSS
The release of NFSv4 brought a revolution to NFS security by mandating the implementation of RPCSEC_GSS and the Kerberos version 5 GSS-API mechanism. However, RPCSEC_GSS and the Kerberos mechanism are also available for all versions of NFS. In FIPS mode, only FIPS-approved algorithms can be used.
With the RPCSEC_GSS Kerberos mechanism, the server no longer depends on the client to correctly represent which user is accessing the file, as is the case with AUTH_SYS. Instead, it uses cryptography to authenticate users to the server, preventing a malicious client from impersonating a user without having that user's kerberos credentials.
注意
It is assumed that a Kerberos ticket-granting server (KDC) is installed and configured correctly, prior to configuring an NFSv4 server. Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC. For more information on Kerberos see Red Hat's Identity Management Guide.
To set up RPCSEC_GSS, use the following procedure:
过程 9.4. Set up RPCSEC_GSS
- Create
nfs/client.mydomain@MYREALM
andnfs/server.mydomain@MYREALM
principals. - Add the corresponding keys to keytabs for the client and server.
- On the server side, add
sec=krb5,krb5i,krb5p
to the export. To continue allowing AUTH_SYS, addsec=sys,krb5,krb5i,krb5p
instead. - On the client side, add
sec=krb5
(orsec=krb5i
, orsec=krb5p
depending on the set up) to the mount options.
For more information, such as the difference between
krb5
, krb5i
, and krb5p
, refer to the exports
and nfs
man pages or to 第 9.5 节 “Common NFS Mount Options”.
For more information on the
RPCSEC_GSS
framework, including how rpc.svcgssd
and rpc.gssd
inter-operate, refer to http://www.citi.umich.edu/projects/nfsv4/gssd/.
9.8.2.1. NFS security with NFSv4
NFSv4 includes ACL support based on the Microsoft Windows NT model, not the POSIX model, because of the former's features and wide deployment.
Another important security feature of NFSv4 is the removal of the use of the
MOUNT
protocol for mounting file systems. This protocol presented possible security holes because of the way that it processed file handles.