Subject: Re: Namespace root server authorization (was Re: [nfsv4] Global namespace for v4.1?)

From: Jon Haswell <[email-masked]>
Date: Tue, 13 Jan 2004 10:40:03 -0800

On Tuesday, 01/13/2004 at 09:46 PST, Brent Callaghan <[email-masked]>
wrote:
> Nicolas Williams wrote:
> > In my view we need to make sure that domain-wide namespace root servers
> > are authorized to dish out those roots and associated referrals, and
for
> > the rest clients will have to trust those namespace root servers to
> > issue referrals only to other NFS servers which can be trusted to not
> > lie about the sub-namespaces delegated to them.
>
> I hate to belabour a point, but if the client interacts directly
> with the name service (rather than through an NFSv4 server intermediary)
> then there is no new "root server authorization" problem to solve.
>
> Those clients that are already using a secure name service (e.g. LDAP or
> Active Directory) have previously authenticated the provider of the
service
> and rely on it to provide lots of other enterprise data.
>
> Data for a global filesystem name service is just an add-on.

I am in 100% agreement to use LDAP etc as the storage for the global
namespace. I am also in agreement that a client can use an LDAP server
directly to find the root of the NFS namespace, resolving the root
authorization problem.

Beyond that I really don't understand why there is the concern about an NFS
server acting as an intermediary to pass on further information about the
structure of the global namespace, i.e. referrals to machines holding
portions of the namespace/data down the tree.

We have to ensure that the server pointed to in LDAP to hold the root of
the NFS space and/or user data is a trusted component of the system, i.e.
the client is pointed to the machine the LDAP server intends and that this
machine can be trusted to actually then store and return the customers
data. What extra levels does the client need in this server to have it pass
on referal information that it read from the LDAP server.

As I stated in an earlier email CIFS, i.e. the active directory world,
relies on their servers to send referrals for the Microsoft DFS scheme,
with the data servers obtaining this information from potentially the
actual directory servers. I don't see NFS V4 needs to be any different to
this and for protocols that support an inband method of referrals they
should use it. Protocols that do not have an inbound mechanism can use an
out of band mechaism, i.e. automounter goes direct to LDAP.

Jon Haswell
IBM Research

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Jon Haswell <[email-masked]>
Date: Tue, 13 Jan 2004 11:53:33 -0800

On Tuesday, 01/13/2004 at 01:31 CST, Nicolas Williams
<[email-masked]> wrote:

<snip>

>
> I see several models for authenticating the namespace configuration:
>
> 1) authenticate the directory servers, secure the channels to them,
> trust their data
>
> 2) authenticate directory data
>
> 3) authenticate namespace root NFSv4 servers, authorize them to serve
> their namespace roots, trust subsequent referrals
>
> 4) authenticate NFSv4 referrals
>
>
> (2) and (4) are not trivial.
>
> (1) we have already.  And (3), I contend, we can get easily.  In fact,
> both (1) and (3) have share the server authorization problem, which has
> been mostly ignored in the LDAP/SASL space -- see the thread that starts
> with
>
> [1]  http://www.imc.org/ietf-sasl/mail-archive/msg01066.html
>
>
> If we can get (3) with ease then why give up on it?
>

I agree, with regard to 3 in particular, establish a method of trusting the
root servers and then rely on a train of trust from them. AFter all if they
store your data you better hope you can trust anything else they give you.

Jon Haswell
IBM Research