Re: IP based ACL and User Based ACL

On 6/4/2019 8:05 AM, Thossaporn (Pommm) Phetruphant wrote:
> Hi Everyone,
> 
> I'm looking to implement IP based ACL and User Based ACL in my openAFS
> setup. The scenario I like to have is :
> 
> Joe have right to access volume  work1.
> Joe sit on a workstation IP address 192.168.0.25
> Joe also have 2nd workstation IP address 192.168.0.125
> Management want Joe to be able to access volume work1 only from
> workstation IP address 192.168.0.25.
> 
> I currently know and have these setup on my openAFS :
> Joe is member of work1
> 
> $ pts membership work1
> Members of work1 (id: xxx) are:
> Joe
> Jane
> Jenny
> work1-ip-whitelist
> 
> $ pts membership work1-ip-whitelist
> Members of work1-ip-whitelist (id: yyy) are:
> 192.168.0.25
> 
> Danny who don't assign in work1 can use his account on workstation
> 192.168.0.25 to access work1 volume. <- I don't want this.
> 
> Is it possible to have ACL that only allow user Joe from workstation IP
> address 192.168.0.25 to access but not allow Danny?
> Basically, User based ACL "and" IP based ACL. Both need to be TRUE to
> authorize access.

The answer to your question is "no", it is not possible to perform
multi-factor authorization in OpenAFS.  OpenAFS neither implements a
method of performing multi-factor (aka combined identity) authentication
nor does it support an access control language that can be used to
implement multi-factor rules.

It should be noted that IP ACLs do not provide any security at the
network layer and are therefore vulnerable to spoofing.

The AuriStor File System preserves the /afs file namespace and is
designed to support exactly the use case which you describe.  Please read

https://www.auristor.com/documentation/man/linux/7/auristorfs_acls.html

Migration to AuriStorFS from OpenAFS can be performed with zero-flag
days with a well tested incremental process.

https://www.auristor.com/documentation/man/linux/7/auristor_migration.html

Please contact me with any questions you might have.

Jeffrey Altman

begin:vcard
fn:Jeffrey Altman
n:Altman;Jeffrey
org:AuriStor, Inc.
adr:Suite 6B;;255 West 94Th Street;New York;New York;10025-6985;United States
email;internet:[email protected]
title:Founder and CEO
tel;work:+1-212-769-9018
note;quoted-printable:LinkedIn: https://www.linkedin.com/in/jeffreyaltman=0D=0A=
	Skype: jeffrey.e.altman=0D=0A=
	
url:https://www.auristor.com/
version:2.1
end:vcard