Re: aname_to_locaname vs gssapi svc/host.domain.org@REALM

On Wed, 2011-10-26 at 12:02 -0500, Nico Williams wrote:
> On Wed, Oct 26, 2011 at 2:53 AM,  <[email protected]> wrote:
> > I'd like to thank you Nico for identifying the core issue.
> 
> Well, I did antagonize Harry a bit, so, maybe it's a wash.  I wish I'd
> seen Harry's point earlier, though I still think Harry should just
> avoid the issue altogether.
> 
> Also, regarding Apache...  Yes, Apache has a legitimate reason for
> being a daemon that is also an NFS (or AFS, or...) client.  However,
> Apache is effectively a proxy for its clients.  Therefore Apache
> either needs to be considered part of the system that the clients are
> accessing and therefore, like the NFS software, fully privileged to
> access all of that system, OR it needs delegated credentials (possibly
> -preferably!- constrained) with which to impersonate the clients to
> the NFS backend.

No; there's a third option, which is that apache is _not_ a proxy, but
also doesn't run with more access than it needs to do its job.  In fact,
to run the non-proxy case as you suggest would a gross violation of the
principle of least privilege.

-- Jeff