Subject: [nfsv4] NFSv4 Persistent Mounts and Authentication

From: Lesley Kimmel <[email-masked]>
Date: Tue, 20 Jun 2017 07:36:59 -0500

All;

Forgive me if this question is somewhat incorrect as we are just getting
started with NFSv4.

It seems that [kerberized] NFSv4 is well suited for things like home
directories that can be authenticated and mounted when a user accesses the
system. However, we are considering a few issues and are wondering what the
recommended configuration is:

1) Users execute a long running job (assume longer than the Kerberos ticket
lifetime) and log out. How can the Kerberos ticket automatically be renewed
so that these types of jobs continue to run?
2) How would CRON jobs executing scripts from an NFS share gain a Kerberos
ticket to be able to perform these actions?

Thanks ahead of time,
-Lesley Kimmel

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 20 Jun 2017 19:00:01 -0500

> so that these types of jobs continue to run?

An impromptu option is to use the k5start utility
(https://www.eyrie.org/~eagle/software/kstart/k5start.html) to wrap
the long-running job, which does involve having k5start store the
plaintext user password in memory for the duration of the job or
turning the password into a keytab file, neither of which are
super-great from asecurity point of view.

A somewhat better option is to issue dedicated additional kerberos
principals to users running long jobs, perhaps as
user/longjobs@REALM or similar.  Those new principals can be granted
access to write to just the needed portion of secure storage and do
not have other privileges granted to the regular user@REALM
principals, so there is less risk in leaving the credentials around
with the long-running job.

> ticket to be able to perform these actions?

Generally the simplest way is to give whatever is running cron
its own principal (e.g., host/a.host.running.cron@REALM) and grant
the necessary filesystem permissions to that additional principal.

-Ben