Subject: [nfsv4] 3530bis Security Considerations text on name service translations

From: Andy Adamson <[email-masked]>
Date: Wed, 5 Sep 2012 12:36:40 -0400

I note that 3530bis has no mention of the need for security in
translating principals or user@dns_domain to/from local
representations.  Here is some proposed text to add to Section 17
Security Considerations of draft-ietf-nfsv4-rfc3530bis-19.txt to be
added after the first paragraph.

   When an NFSv4 mandated security model is used and a security principal or
   an NFSv4 name in user@dns_domain form needs to be translated to or
from a local
   representation as described in Section 5.9, the translation SHOULD be done
   in a secure manner that preserves the integrity of the translation.

I could add an example, something like:

LDAP with TLS is an example of a name service with acceptable security
while NIS, due to lack of security is not.

I think something similar needs to be added to RFC 5661 Security Considerations.

Comments please.

Thanks

-->Andy

---

From: "Noveck, David" <[email-masked]>
Date: Wed, 5 Sep 2012 15:10:53 -0400

Good point.

I'd change "NFSv4 mandated" to "NFSv4-mandated" or else say "When a security model mandated by NFSv4 is used"

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Andy Adamson
Sent: Wednesday, September 05, 2012 12:37 PM
To: Tom Haynes
Cc: NFSv4
Subject: [nfsv4] 3530bis Security Considerations text on name service translations

Comments please.

Thanks

-->Andy
_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: Andy Adamson <[email-masked]>
Date: Thu, 6 Sep 2012 09:11:01 -0400

OK. I like this, with no mention of LDAP versus NIS:

 When a security model mandated by NFSv4 is used and a security principal or
 an NFSv4 name in user@dns_domain form needs to be translated to or
 from a local representation as described in Section 5.9, the translation SHOULD
 be done in a secure manner that preserves the integrity of the translation.

-->Andy

---

From: "Haynes, Tom" <[email-masked]>
Date: Fri, 7 Sep 2012 20:13:20 +0000

Will be added for the next draft.

---
Empower the team to own quality.

On Sep 6, 2012, at 8:11 AM, Andy Adamson <[email-masked]<mailto:[email-masked]>> wrote:

-->Andy

On Wed, Sep 5, 2012 at 3:10 PM, Noveck, David <[email-masked]<mailto:[email-masked]>> wrote:
Good point.

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Andy Adamson
Sent: Wednesday, September 05, 2012 12:37 PM
To: Tom Haynes
Cc: NFSv4
Subject: [nfsv4] 3530bis Security Considerations text on name service translations

Comments please.

Thanks

-->Andy
_______________________________________________
nfsv4 mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/nfsv4

_______________________________________________
nfsv4 mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: "Black, David" <[email-masked]>
Date: Fri, 7 Sep 2012 17:34:37 -0400

Sorry to be a pain, but what does "in a secure manner" mean in practice?

Thanks,
--David

From: [email-masked] [mailto:[email-masked]] On Behalf Of Haynes, Tom
Sent: Friday, September 07, 2012 4:13 PM
To: Andy Adamson
Cc: NFSv4
Subject: Re: [nfsv4] 3530bis Security Considerations text on name service translations

---

-->Andy

Good point.

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Andy Adamson
Sent: Wednesday, September 05, 2012 12:37 PM
To: Tom Haynes
Cc: NFSv4
Subject: [nfsv4] 3530bis Security Considerations text on name service translations

Comments please.

Thanks

-->Andy

---

From: "Haynes, Tom" <[email-masked]>
Date: Sat, 8 Sep 2012 16:18:36 +0000

On Sep 7, 2012, at 4:34 PM, "Black, David" <[email-masked]<mailto:[email-masked]>> wrote:

Sorry to be a pain, but what does “in a secure manner” mean in practice?

Thanks,
--David

Andy provided that information in his original email:

---

From: "Black, David" <[email-masked]>
Date: Mon, 10 Sep 2012 08:54:44 -0400

I think the requirements for "acceptable" security need to be stated in addition to giving an example.

Thanks,
--David

From: Haynes, Tom [mailto:[email-masked]]
Sent: Saturday, September 08, 2012 12:19 PM
To: Black, David
Cc: Andy Adamson; nfsv4 list
Subject: Re: [nfsv4] 3530bis Security Considerations text on name service translations

Thanks,
--David

---

From: Andy Adamson <[email-masked]>
Date: Fri, 14 Sep 2012 15:20:27 -0400

How does this parse?

   When an NFSv4 mandated security model is used and a security principal or
   an NFSv4 name in user@dns_domain form needs to be translated to or from a
   local representation as described in Section 5.9, the translation SHOULD be
   done in a secure manner that preserves the integrity of the translation.  For
   communication with a name service such as LDAP [reference rfc4511],
 this means
   employing a security service that uses authentication and data
integrity. Kerberos and
   TLS [reference rfc5246] are examples of such a security service.

-->Andy

On Mon, Sep 10, 2012 at 8:54 AM, Black, David <[email-masked]> wrote:
> I think the requirements for “acceptable” security need to be stated in
> addition to giving an example.
>
>
>
> Thanks,
> --David
>
>
>
> On Sep 7, 2012, at 4:34 PM, "Black, David" <[email-masked]> wrote:
>
>
>

---

From: "Black, David" <[email-masked]>
Date: Fri, 14 Sep 2012 18:04:21 -0400

Much better, Thanks, --David

> From: Andy Adamson [mailto:[email-masked]]
> Sent: Friday, September 14, 2012 3:20 PM
> To: Black, David
> Cc: Haynes, Tom; nfsv4 list

---

From: "Haynes, Tom" <[email-masked]>
Date: Wed, 19 Sep 2012 19:07:58 +0000

Okay, I've pushed this to 3530bis and the underground copy of 5661bis.

---

On 9/14/12 2:20 PM, "Andy Adamson" <[email-masked]> wrote:

>from a
>> I think the requirements for ³acceptable² security need to be stated in
>> Subject: Re: [nfsv4] 3530bis Security Considerations text on name
>>service
>> translations
>>
>>
>>
>> Sorry to be a pain, but what does ³in a secure manner² mean in practice?
>>
>>
>>
>> Thanks,
>> --David
>>
>>
>>
>>
>>
>>
>>