Re: aname_to_locaname vs gssapi svc/host.domain.org@REALM

On Sat, 2011-10-22 at 17:38 +0200, [email protected] wrote:
> Note that there is a general and straightforward workaround - letting a
> daemon use different Kerberos credentials for its own service and for
> accessing the NFS service. This should be easy to setup (_is_ easy on
> Linux, did not test on other client platforms).

This is an important point.  Both convention and standards encourage the
use of principal names of the form service/host.fqdn for host-based
_services_.  However, the behavior of Sun's NFS notwithstanding, there
is no similar convention dicating the use of user/host.fqdn to name
principals belonging to _users_ on a particular host.  That is, while
LDAP clients expect your LDAP server to have the principal name
ldap/server.example.com, there is nothing that says that a process
running as local user 'ldap' on host 'server.example.com' must or even
should use that principal name when authenticating to other services.

Of course, that doesn't help if for some reason you want everything
running as 'ldap' on hundreds of machines to all be able to access files
on the NFS server with the rights of (NFS server) user 'ldap', but don't
want to give them all the key for the 'ldap' user.



> Services other than NFS and login do not need mapping to host-local names
> anyway.

Yes and no.  Certainly there are services other than NFS and login which
result in access to files, processes, or other resources belonging to a
particular user.  For example, ssh and FTP both fall into that class.
Conversely, a file server does not necessarily need such a mapping; what
it needs is a mapping to whatever it uses to track file ownership and
access controls.  It just happens that a common NFS implementation model
is to track such things using small integers in the same namespace used
for tracking ownership of files and processes on the machine on which
the server runs.  Of course, this is a terribly convenient model if the
NFS server in question happens to simply export the contents of some
local filesystem as-is.  But not all fileservers, nor even all NFS
servers, work that way.

-- Jeff