Subject: Re: [nfsv4] NFSv4 Global namespace: joining NFSv4 domains with a new DNS nfsv4 SRV.

From: Jim Rees <[email-masked]>
Date: Thu, 19 Jan 2006 18:55:09 -0500

Shouldn't the client's authentication of the server be part of gss, not part
of dns?

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 19 Jan 2006 18:06:03 -0600

> Shouldn't the client's authentication of the server be part of gss, not part

I listed two solutions, one is to use DNSSEC, the other is to use
domain-based service principal names for the server -- as in GSS
principal names.

Host-based service principal names, you'll recall, name a service and a
hostname.

Domain-based service principal names, which are proposed in the KITTEN
WG, name a service, a domain and a hostname.

The idea is that you want to authenticate {nfs, domainname, host.fqdn},
not {nfs, host.fqdn} when the server is a domain root server obtained
through an insecure DNS SRV RR lookup.  Then the domain administrator
could ensure that only domain root NFSv4 servers have credentials for
such domain-based service principal names.

NFS is not the only potential consumer of domain-based service principal
names, so is LDAP, and probably other services also.

Nico
--