["Steven French" <sfrench@us.ibm.com>]

>On Oct 04, 2002  16:35 +0100, David Howells wrote:
>
> > NFSv4 does indeed require the full kerberos encryption stuff in the
> > kernel. The RFC specifies that krb5 support is a minimum requirement
> > will expect to have that in 2.6 (or 3.0 or whatever it's called these
> > days...)
>
> Might this be something I can make use of for my AFS filesystem too?

>We will also need kerberos for Lustre when we start implementing
>security.  We will be using the GSSAPI for security, so basically
>the same as what AFS is using.
>
>Cheers, Andreas

The CIFS VFS (http://cifs.bkbits.net/linux-2.5) can get by with
just the kerberos service ticket encapsulation routines (negTokenInit,
negTokenTarg ala SPNEGO/GSSAPI) in kernel, and I have made a start
coding the cifs version of that since it will be a big benefit when
mounted to Samba 3.0 and this is almost required for decent Windows
2000 and .Net server security interoperability.  It would be useful
to come up with a generalized way to request new & refresh
expired service tickets - perhaps from a pam/nss daemon something
like what the current version of the Winbind daemon does now. In the
interim, raw (i.e. non-SPNEGO encapsulated) NTLMSSP (or NTLM ala older
clients) is used in the CIFS VFS.  Having a common call to get
at the kerberos tickets for a particular uid would be very helpful,
otherwise each remote filesystem might eventually code a different
IPC to a different user space mount or pam/nss helper
(e.g. Winbind for CIFS) to aquire a kerberos ticket that is opaque to
the particular filesystem.


Steve French
Senior Software Engineer
Linux Technology Center - IBM Austin
phone: 512-838-2294
email: sfrench@us.ibm.com