Subject: RE: [nfsv4] Fwd: [[email-masked]: I-D ACTION: draft-mesta-nfsv4-domain-00.txt]

From: "Wachdorf, Daniel R" <[email-masked]>
Date: Mon, 1 Nov 2004 10:46:19 -0700

The draft does not address the problem of how to obtain an NFSv4 domain
for a user given their Kerberos principal name (or other GSSAPI
identities).  If there is a case where a site has a Kerberos realm
different from their DNS domain, clients and servers have the need to
map the Kerberos realm to NFSv4 domain.  

Secondly, using DNS to provide the Kerberos realm to nfsv4 domain would
raise some serious security concerns.

-dan

-----Original Message-----
From: Rick Mesta [mailto:[email-masked]] 
Sent: Thursday, October 21, 2004 4:56 PM
To: [email-masked]
Cc: Rick Mesta
Subject: [nfsv4] Fwd: [[email-masked]: I-D ACTION:
draft-mesta-nfsv4-domain-00.txt]

	FYI,
		rick

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 1 Nov 2004 12:47:01 -0600

> map the Kerberos realm to NFSv4 domain.  

It doesn't have to.

That's a separate problem altogether, in fact, it is NOT a problem, IMO.

Do not conflate principal->user/groups mapping with user/group@domain <->
UID/GID/SID/... mapping.  The two are very different problems.

> raise some serious security concerns.

That is not what is being done.  Using DNS at all, mind you, raises
serious security concerns; namely, one should use DNSSEC.  But note that
the RR lookup proposed in Rick's I-D is local, for the local host, and
not related to NFS peers, which means that global DNSSEC deployment is
not necessary for this proposal to be secure.

Nico
--