Presentation is loading. Please wait.

Presentation is loading. Please wait.

Remote Name Mapping Linux NFSv4 Andy Adamson Center For Information Technology Integration University of Michigan.

Published by Modified over 8 years ago

Similar presentations

Presentation on theme: "Remote Name Mapping Linux NFSv4 Andy Adamson Center For Information Technology Integration University of Michigan."— Presentation transcript:

1

2 Remote Name Mapping Linux NFSv4 Andy Adamson Center For Information Technology Integration University of Michigan

3 NFSv4 Administrative Domain Multiple DNS domains Multiple Security Realms Kerberos, PKI Certificate Authorities (SPKM3) NFSv4 domain = unique UID/GID namespace Pick one DNS domain to be the NFSv4 Domain Name ACL 'who' and GETTATTR owner and owner_group

4 Local NFSv4 Domain Name to ID One to one correspondence between UID and NFSv4 domain name joe@arbitrary.domain.org GSS Principal name will differ from NFSv4 domain name Kerberos V: joe@ARBITRARY.DOMAIN.ORG PKI: OU=US, OU=State, OU= Arbitrary Inc, CN = Joe User Email= joe@arbitrary.domain.org

5 Local Mount: Kerberos V v4 Domain v4 Domain: arbitrary.domain.org K5 Realm: TANGENT.REALM DNS Domain: citi.umich.edu LDAP NFSv4 Client nfs/host.citi.umich.edu@TANGENT.REALM /etc/krb5.keytab NFSv4 Server GSSD gss context creation nfs/host.citi.umich.edu@TANGENT.REALM Secure LDAP Call FAILS If machine name, map to nobody gss context call succeeds GSSD

6 Local Mount: Kerberos V Issues Distribution of client keytabs Client service name UID/GID mapping for client machine principals? Related issue: Client root user Map to machine principal Map to root principal Map to nobody other

7 Local Principal: Kerberos V v4 Domain v4 Domain: arbitrary.domain.org K5 Realm: TANGENT.REALM DNS Domain: citi.umich.edu LDAP NFSv4 Client joe@TANGENT.REALM % kinit joe@TANGENT.REALM NFSv4 Server GSSD gss context creation joe@TANGENT.REALM GSSAuthName:joe@TANGENT.REALM uidNumber: 10098 gidNumber: 10 gss context creation succeeds /tmp/krb5cc_UID GSSD secure LDAP call v4 Domain

8 Local Principal: Kerberos V Issues Where to put kinit credentials for client GSSD /tmp/krb5cc_UID getpwid on principal portion assumes UNIX name (posixAccount uid) == K5 principal Current code, getpwid => LDAP query GSSAuthName attribute added to posixAccount to associate with uidNumber Server GSSD principal mapping failure = contest creation failure

9 Local User: Set ACL v4 Domain: arbitrary.domain.org K5 Realm: TANGENT.REALM DNS Domain: citi.umich.edu LDAP NFSv4 Client % setfacl -m u:joe:rw /tmp/x.c NFSv4 Server /tmp/x.c 10098:rw NFSv4Name: joe@arbitrary.domain.org uidNumber: 10098 IDMAPD 1010 uid: joe joe 10098 joe@arbitrary.domain.org SETATTR joe@arbitrary.domian.org 10098

10 Local User: Set ACL issues setfacl POSIX interface uses UID/GID across kernel boundary LDAP posixAccount: uid is mapped need a local name two name mapping calls LINUX nfs4_setfacl interface passes string names across kernel boundary no local name needed

11 Local User: Get ACL v4 Domain: arbitrary.domain.org K5 Realm: TANGENT.REALM DNS Domain: citi.umich.edu LDAP NFSv4 Client % getfacl /tmp/x.c NFSv4 Server /tmp/x.c 10098:rw NFSv4Name: joe@arbitrary.domain.org uidNumber: 10098 IDMAPD 1010 uid: joe GETATTR 10098 joe@arbitrary.domain.org 10098 joe

12 Local User: Get ACL issues getfacl POSIX interface uses UID/GID across kernel boundary LDAP posixAccount: uid is displayed two name mapping calls LINUX nfs4_getfacl interface passes string names across kernel boundary

13 Kerberos V X-Realm and Linux NFSv4 X-realm GSS context initialization just works Need to add GSSAuthName and UID/GID mapping for remote user NFSv4RemoteUser schema can be used instead of posixAccount NFSv4 remote access without local machine access mount from remote machine: mapping library needs to recognize service portion of name Secure LDAP communication required

14 Remote Kerberos V Principal v4 Domain v4 Domain: arbitrary.domain.org K5 Realm: TANGENT.REALM DNS Domain: citi.umich.edu LDAP NFSv4 Client andros@CITI.UMICH.EDU % kinit andros@CITI.UMICH.EDU NFSv4 Server GSSD gss context creation andros@CITI.UMICH.EDU GSSAuthName:andros@CITI.UMICH.EDU uidNumber: 10075 gidNumber: 10 gss context creation succeeds /tmp/krb5cc_UID GSSD secure LDAP call v4 Domain v4 Domain: citi.umich.edu K5 Realm: CITI.UMICH.EDU DNS Domain: citi.umich.edu

15 Remote User: Set ACL v4 Domain: arbitrary.domain.org K5 Realm: TANGENT.REALM DNS Domain: citi.umich.edu NFSv4 Client % setfacl -m u:andros:rw /tmp/x.c NFSv4 Server /tmp/x.c andros 23975 SETATTR IDMAPD LDAP NFSv4Name: andros@citi.umich.edu uidNumber: 10075 1010 23975 v4 Domain: citi.umich.edu K5 Realm: CITI.UMICH.EDU DNS Domain: citi.umich.edu LDAP NFSv4Name:andros@citi.umich.edu uidNumber: 23975 uid: andros andros@citi.umich.edu 10075 10075:rw

16 Remote User: Set ACL Remote realm: associate NFSv4Name with uidNumber, gidNumber, and GSSAuthName NFSv4RemoteUser schema available NFSv4domain name always used Secure LDAP communication required

17 Remote User: Get ACL v4 Domain: citi.umich.edu K5 Realm: CITI.UMICH.EDU DNS Domain: citi.umich.edu LDAP NFSv4 Client % getfacl /tmp/x.c NFSv4 Server /tmp/x.c 10075:rw NFSv4Name: andros@citi.umich.edu uidNumber: 10075 IDMAPD 1010 GETATTR 10075 andros@citi.umich.edu 23975 andros v4 Domain: arbitrary.domain.org K5 Realm: TANGENT.REALM DNS Domain: citi.umich.edu LDAP NFSv4Name: andros@citi.umich.edu uidNumber: 23975 uid: joe

18 Remote User: Get ACL LDAP mappings required only for POSIX getfacl NFSv4Name and uidNumber for remote user uid (local user name) for remote user nfsv4_getfacl simply displays the on-the-wire ACL name Secure LDAP not required

19 Any Questions? http://www.citi.umich.edu/projects

Download ppt "Remote Name Mapping Linux NFSv4 Andy Adamson Center For Information Technology Integration University of Michigan."

Similar presentations

Security Issues in Mobile Code Systems David M.Chess, High Integrity Computing Lab, IBM T.J. Watson Research Center Hawthorne, NY, USA Mobile code systems.

Security Issues in Mobile Code Systems David M.Chess, High Integrity Computing Lab, IBM T.J. Watson Research Center Hawthorne, NY, USA Mobile code systems.
CN 8822. Objectives of the course To build and maintain a UNIX-based Network Systems & Servers Install Linux, fine tune the system, enable required server,

CN Objectives of the course To build and maintain a UNIX-based Network Systems & Servers Install Linux, fine tune the system, enable required server,
Decentralized User Authentication in a Global File System Max Meisterhans - Seminar in Distributed Computing WS 05/06.

Decentralized User Authentication in a Global File System Max Meisterhans - Seminar in Distributed Computing WS 05/06.
Remote Name Mapping for Linux NFSv4 Andy Adamson Center For Information Technology Integration University of Michigan August 2005.

Remote Name Mapping for Linux NFSv4 Andy Adamson Center For Information Technology Integration University of Michigan August 2005.
Authenticated QoS Signaling William A. (Andy) Adamson Olga Kornievskaia CITI, University of Michigan.

Authenticated QoS Signaling William A. (Andy) Adamson Olga Kornievskaia CITI, University of Michigan.
Nfsv4 and linux peter honeyman linux scalability project center for information technology integration university of michigan ann arbor.

Nfsv4 and linux peter honeyman linux scalability project center for information technology integration university of michigan ann arbor.
Access Control Chapter 3 Part 3 Pages 209 to 227.

Access Control Chapter 3 Part 3 Pages 209 to 227.
Cross Platform Single Sign On using client certificates Emmanuel Ormancey, Alberto Pace Internet Services group CERN, Information Technology department.

Cross Platform Single Sign On using client certificates Emmanuel Ormancey, Alberto Pace Internet Services group CERN, Information Technology department.
LDAP and Kerberos: An Overview Leveraging services provided by Active Directory for Unix/Linux authentication, authorization and name services Jason Testart.

LDAP and Kerberos: An Overview Leveraging services provided by Active Directory for Unix/Linux authentication, authorization and name services Jason Testart.
Unix/Windows Inter-Operability. What do we want? Single Username Password Access Users files (N drive) – Personal Machine – Multi-User Machines Information.

Unix/Windows Inter-Operability. What do we want? Single Username Password Access Users files (N drive) – Personal Machine – Multi-User Machines Information.
How to Succeed with Active Directory Robert Williams, PhD CEO Secure Logistix Corporation.

How to Succeed with Active Directory Robert Williams, PhD CEO Secure Logistix Corporation.
Naming Computer Engineering Department Distributed Systems Course Asst. Prof. Dr. Ahmet Sayar Kocaeli University - Fall 2014.

Naming Computer Engineering Department Distributed Systems Course Asst. Prof. Dr. Ahmet Sayar Kocaeli University - Fall 2014.
Authenticated QoS Project Overview Andy Adamson Research Investigator Center for Information Technology Integration University of Michigan Ann Arbor.

Authenticated QoS Project Overview Andy Adamson Research Investigator Center for Information Technology Integration University of Michigan Ann Arbor.
3.1 © 2004 Pearson Education, Inc. Exam 70-290 Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 3: Introducing Active Directory.

3.1 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 3: Introducing Active Directory.
CS603 Active Directory February 1, 2001.

CS603 Active Directory February 1, 2001.
Challenges Running an NFSv4- backed OSG Cluster Kevin Coffman Center for Information Technology Integration University of Michigan.

Challenges Running an NFSv4- backed OSG Cluster Kevin Coffman Center for Information Technology Integration University of Michigan.
3.1 © 2004 Pearson Education, Inc. Exam 70-290 Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 3: Introducing Active Directory.

3.1 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 3: Introducing Active Directory.
Naming Names in computer systems are used to share resources, to uniquely identify entities, to refer to locations and so on. An important issue with naming.

Naming Names in computer systems are used to share resources, to uniquely identify entities, to refer to locations and so on. An important issue with naming.
Naming And Directory Services Geetika Sharma 09/22/200 8 CSC8320.

Naming And Directory Services Geetika Sharma 09/22/200 8 CSC8320.
By Karan Oberoi.  A directory service (DS) is a software application- or a set of applications - that stores and organizes information about a computer.

By Karan Oberoi.  A directory service (DS) is a software application- or a set of applications - that stores and organizes information about a computer.

Similar presentations

Ads by Google