Re: mount.cifs with sec=krb5 where kerberos principal is not the same as file server
Jeff Layton <[email protected]>
| Newsgroups | gmane.linux.file-systems.cifs |
|---|---|
| Message-ID | <[email protected]> |
On Wed, 28 Oct 2009 13:49:58 +0100 Andrew Baumann <[email protected]> wrote: > Hi Jeff, > > On Wednesday 28 October 2009 13.31:27 Jeff Layton wrote: > > The reason is that while CIFS doesn't currently do mutual krb5 > > authentication, eventually it should. The problem with trusting the > > mechListMIC is that it makes the client susceptible to > > man-in-the-middle attacks. An attacker could redirect traffic to a > > server of his choosing (perhaps by spoofing DNS) and the client would > > be none the wiser. > > Hm, I see. Do you happen to know if smbclient does this? In the interim, > perhaps it would be useful to have a mount option that could specify the > service principal explicitly. > Actually...I'm not terribly opposed to adding a mount option for this. If someone wants to do the legwork on it and propose a patch, I'll be happy to help review it. -- Jeff Layton <[email protected]>