Re: root/ host/ <uid 0 service like nfs>/ ?!?

On 10/4/2011 4:14 PM, Nico Williams wrote:
> On Tue, Oct 4, 2011 at 4:09 PM, Harry Coin<[email protected]>  wrote:
>> Is there a settled intention or reference for the nuances among 'uid 0
>> principals'?
>>
>> Though I don't see it set forth as such, my sense is that for principals:
>>
>> root/<fqdn>@REALM is intended to mean a person logged in and issuing
>> commands as local uid 0 / root on<fqdn>.
>>
>> <other-than-host>/<fqdn>@REALM is intended to be the name of a
>> daemon/service/non-person-with-at-least-one-process-id, possibly with uid:0,
>> running on<fqdn>.  Viz: nfs4 server/0.  ldap uid varies *bsd/*nix, etc.
>>
>> host/<fqdn>@REALM is intended to be a 'catch all' principal for all uid:0
>> services running on<fqdn>  that, well, what?  Missed the memo above?   Got
>> it correct? What?
>>
>> Is there consensus about what 'best practice' is in this regard?
> Not really.
>
> Here's what Solaris does when an euid == 0 process wades into a secure
> NFS share:
>
>   - if there's root/hostname.fqdn, use that
>   - else if there's host/hostname.fqdn, use that
>
> I forget the details.
>
> Also, Solaris uses the automount triggering process' GSS credentials,
> so you don't have to have host credentials just to do mounts.
>
> Nico
> --
>
Nico, right.

And Linux nfs4 client when doing a mount for uid 0 asks for the 
nfs/<fqdn> principal... but, in an abundance of pragmatism, riffles 
through the keytab looking for, in order: root/<host>@<REALM>, 
nfs/<host>@<REALM>, host/<host>@<REALM>,  root/<whatnot>@REALM, 
nfs/<whatnot>@<REALM>, host/<whatnot>@<REALM>.

Seeming to indicate that 'root/' is to mean not a person (nevermind root 
is the only uid:0 account a person can log into with a shell and all), 
while 'host/' appears in the above example as sort of a sorry deprecated 
synonym for 'root'.

There is clarity as principals when people have their account and their 
account/admin principals.   Hoping to extend that clarity to the root / 
service <-> principal naming best practices.

Is there consensus that a common understanding has merit for 
<whatnot>/<fqdn> means?