Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Trond Myklebust <trondmy@kernel.org>
CC:     Rick Macklem <rick.macklem@gmail.com>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Subject: Re: RFC:Doing a NFSv4.1/4.2 Kerberized mount without a machine
 credential
Thread-Topic: RFC:Doing a NFSv4.1/4.2 Kerberized mount without a machine
 credential
Thread-Index: AQHZH9vamVQSE8pdpU+4JSLI/7+74a6NhDYAgAAR0QCAABflgIAAoyIAgAAybACAAAtjgA==
Date:   Wed, 4 Jan 2023 18:06:40 +0000
Message-ID: <15C694E4-925B-47E6-A054-644A0A142F88@oracle.com>
References: <CAM5tNy6nfvuqM30DwUVjTFHfewL8tSEQcyEJsSBzyWMTvDkEQw@mail.gmail.com>
 <e9fea39e926486146505c385dca50c116deb22f9.camel@kernel.org>
 <CAM5tNy7GM-5m-O2GUBwXCY=psSN2LKiE4bPPFyK=ABhObMdFCg@mail.gmail.com>
 <6ed7866da1e57a46da0108e9581242cd7f1ef2ce.camel@kernel.org>
 <FBAF6EA3-D78E-4F62-ACDB-8582973B4A93@oracle.com>
 <52f00169bb54c082dbffbcbf999c8096cb16d25d.camel@kernel.org>
In-Reply-To: <52f00169bb54c082dbffbcbf999c8096cb16d25d.camel@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?JciiazT8gXWMRTkfWtfINdBZg3ke97VDNVT3W/uAQJ2DcAl1f+6RA8CpNs6H?=
 =?us-ascii?Q?yq01xANwQzwxbiPe7J6V/IPFONPCo8e9RKz/djkSFEVPFXBtd1qgO3X79GjJ?=
 =?us-ascii?Q?dtYsGzy80sGMj2PbeBhCvIWNY2EJaDmDiG8qoyaelZG5SzXvbArpW+ULF0LA?=
 =?us-ascii?Q?OvkoZNe4hrbse7+TddvWY9YG6Od6j9CaFl1cjZClO8lF1fb8sousI3CNelK8?=
 =?us-ascii?Q?qrXuDtZ7UouQhKTNkHPYLi9fJDzoO/GT7L9E4G53r/xwRSEprtoPwijlJazN?=
 =?us-ascii?Q?lBxM9yay28kQtdCkygiCGh36D690klCY9RBnSuwyrawT47AWaw2SU94YoYf2?=
 =?us-ascii?Q?OL5TbdU3noelsTMOO71ba/beEhCB/zscCxHxf58Ik+YHlkIpZS9qFZUPS0H3?=
 =?us-ascii?Q?U4R8umkceCdMkBBJaAuwNpUxle4Jin3fvy4HX59iA+PE5VGk+hOWT5V1i6Wt?=
 =?us-ascii?Q?7mq0eavIUnicUWkSQ856e1w4a0B6RSjRHIBUczEQgNdww/9sKg1WLouMD/+P?=
 =?us-ascii?Q?0MU7t+Z46JVQFUW6WuZNf5HAufEaJbMcv5VSKwFTBJIrWqV3zgaize5aJt7P?=
 =?us-ascii?Q?IFdfisMwNsEbABncCvmvGD5Zlj7MAjgZIbRcL23Vm8LjDfb5L1ZkMjc//YUw?=
 =?us-ascii?Q?OaiQqj6f0uYUIszwHP4AOV4PmuYLy4fZcoIXDs9VgkXjHr0t38DQ4j0K2p25?=
 =?us-ascii?Q?jQ3o3yYY2hl4L42zNYT3XDzeebvOzDjO4bE1/n4Y9/DtEScfzt8P4TzCmqkQ?=
 =?us-ascii?Q?yNMLa2AErCMw+s5H0Cvjlzjf2ZqC12fqj46L1PcKZVhY6SqKCEKvV4t6wXYb?=
 =?us-ascii?Q?D2iODKZdi+7+4789C2F6dTdYsPf0OZS9HHjbb0EF5bg7onl2ZgeH6LJuw7i6?=
 =?us-ascii?Q?YoV57eus53KQIdW24Ac/CCJxJt6JqJUOVNh7CyGaZ3uJJPjjSUEyVBckm7xP?=
 =?us-ascii?Q?ZwL77YkgakNC9CBlc55iwyNQfdhkeJvZvHdIfAZCXCOfYYyqhAEYu0Z2Jtry?=
 =?us-ascii?Q?/yeUt0oIjTA361CzW/LJ6zOEazmu/hf+Kfexo0ixhdCNe1zMqmQDiPAqxnJ/?=
 =?us-ascii?Q?EbtSzNBHrVobozzCeJxwxD4gVW105kuP0hb2PFMtri6D/SnmC+Lid0GlmOwn?=
 =?us-ascii?Q?Xvj6dE1UyxZUiTKdEZWe81CTdVTd1xqRj5fzxR4MB3dfCQ1btYbtM7MQeFBb?=
 =?us-ascii?Q?HxkP0JqZW2bKh8cGoQFdMCaoal90DQ+vwlixezWGy/E7PjNFwnt+6zFOo5Ft?=
 =?us-ascii?Q?g1iAvxIPzdZnVA5nS5CfLVGn07ri/FUA0U3DEFlObmmdzgBKVYB4Cg5u70QY?=
 =?us-ascii?Q?X0ZpE39n0ioE2keasmC6rFa8Ky/s9kkoU+GCxL5inXdgXowZ4/FlMDzTSGXl?=
 =?us-ascii?Q?4NvSjq0HidR+LLIIKqk+qWPgGpsi7aw7cdf+5o4IGdbxJnmzEyJV9JyZLwQ4?=
 =?us-ascii?Q?TKyGFyMTvE1CT5ziJ7LCl2MZpy1tyRGfD6JHO1xyNfLwDcI+6YJxyZ8UFPvg?=
 =?us-ascii?Q?iYKeoH8tm+UIXps6PpkZQD6ufd1zMoe1AWhmefNUEzXdDsK8tufNkrpTFlht?=
 =?us-ascii?Q?awhOvIC+UTe4lpWcdzXj+RTwlxJ/rk+HAz9s5y7aXaQuSnjFdWwVhIlhb5d/?=
 =?us-ascii?Q?zA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <4D74CAAAD2073D46A0C14F827450F317@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: Uc1lL8Ta3hzBqsRPsNP1lu3MwQnbyXzekvrqP/5k9BtPZhbVvHZI4vu5p4WK1Z98+TLbixkyqFzC7fWjtrKKHsvLMmVcAXAhCWvf+ZTL3y0J9B4Ot4B3Dw4cvoWlSuacGF42s1C2xLgyq0oh0mQMFHjBTieAXw1svpjX7OuEktR3IikCjXk5rTILv/EHsUAzYYHy9G4/HfaF+fGmlDWy0TpWu7h1rxfszG544ATMpXv1Xixbd1q9uA7esr2QIBx1TazkAJlST+Od5eHbQyHu3odNUb0WRE6MoyU1aBGAx4gLK1llnmd+wAN7sH68vsayo86AF13kPfq949/aH7gip5b+GOLSvFJnUDqUM2ULGObYppx7CqunDRkDGZmpmsTce01/xrrnX7NE8Qt9MtisI5aK5Yy6BAWW/2O2n3U+XNEy70IuwEv4X6r+FTHFFXqdes750lSck67uVzKa18FNpgu+bozVTlxpgPp5ifQ/iTinhPRKT7K6zvPh85OQ3s4yC9YbJXQr75ICphqxwZyNeDtUbrYqKMxv9JRrIwEO3PqGqH+gerJBPLXuobbDjzmF+V5VIBzoN0Rt1oqPY9oS50kp2kqJZAGnUUMZLFPtjAWCScDY/hyw5+BFAMwSUmeEMgXrFBUIoLUZn7VKWy/5stG39FqyqP3Iu+SjXBXqgbilzMdklsDck9VUtO/iRZTfkt1zV6RvilLlYIdGExF88dHsZhr+qEPsBPmDJNgMRMTYcGnOIKqHZme/VsGPkJJ2roYMdz2+fG0tXIWsggUqjM7jTMcYf5exwxyxr9ClyFg+JFbvky9MsRw3M2WCtnk0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7bc186ab-12a9-48aa-2d3c-08daee7e6e2a
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Jan 2023 18:06:40.7425
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Bb8JurtUU+K0i0q8vOUmNyN4v8VGLaqGf5Fgrc7yN/c9BfBfp4ZceNoSkbKK7XFTSkMi0VMmrXfJCiLacgbdBA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN4PR10MB5575
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.923,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2023-01-04_07,2023-01-04_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxlogscore=999
 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 mlxscore=0
 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2212070000 definitions=main-2301040151
X-Proofpoint-GUID: PW6AD_FDYpuASKQSHmvJV433CUKqpRXY
X-Proofpoint-ORIG-GUID: PW6AD_FDYpuASKQSHmvJV433CUKqpRXY
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Jan 4, 2023, at 12:25 PM, Trond Myklebust <trondmy@kernel.org> wrote:
>=20
> On Wed, 2023-01-04 at 14:25 +0000, Chuck Lever III wrote:
>>=20
>>=20
>>> On Jan 3, 2023, at 11:41 PM, Trond Myklebust <trondmy@kernel.org>
>>> wrote:
>>>=20
>>> I've been thinking about how to use a public key infrastructure to
>>> provide stronger authentication of multiple individual users' RPC
>>> calls
>>> and multiplexing them across a shared TLS connection.
>>>=20
>>> Since the client trusts the server through the TLS connection
>>> authentication mechanism, and you have privacy guaranteed by that
>>> TLS
>>> connection, then  really all you want to do is for each RPC call
>>> from
>>> the client to be able to prove that the caller has a specific valid
>>> identity in the PKI chain of trust.
>>>=20
>>> So how about just defining a simple credential (AUTH_X509 ?)
>>> containing
>>> a timestamp, and a distinguished name, and have it be signed using
>>> the
>>> (trusted) private key of the user? Use the timestamp as the basis
>>> for a
>>> TTL for the credential so that the client+server don't have to keep
>>> signing a new cred for each and every RPC call for that user, and
>>> allow
>>> the client to reuse the cred for a while as a shared secret, once
>>> the
>>> signature has been verified by the server.
>>=20
>> A laptop typically has a single user. The flexibility of identity
>> multiplexing isn't necessary in this particular scenario.
>>=20
>=20
> Yeah, I don't particularly care about laptop use cases. Most
> enterprises set up VPNs for dealing with them because users typically
> need access to more services than just a NFS server.

The trend I've seen is that enterprises are moving their important
services out of from behind VPNs and into the cloud. Each such
service is responsible for providing appropriate levels of
authentication and confidentiality via a single-sign on service
and an in-transit encryption capability.


> I am interested in the general problem of authenticating RPC users
> using certificates, since that is becoming more common due to the rise
> of S3 object storage and cloud services. While AD and krb5+LDAP can be
> extended into those environments too, there are plenty who choose not
> to, because PKI is generally sufficient, and can be more flexible.

We had SPKM. Would that not work?

--
Chuck Lever