filesystems/nfs/rpc-server-gss.rst

2 rpcsec_gss support for kernel RPC servers
6 implement RPCGSS authentication in kernel RPC servers such as the NFS
13  - RFC2203 v1: https://tools.ietf.org/rfc/rfc2203.txt
14  - RFC5403 v2: https://tools.ietf.org/rfc/rfc5403.txt
18  - RFC7861 v3: https://tools.ietf.org/rfc/rfc7861.txt
35 - initial context establishment
36 - integrity/privacy protection (signing and encrypting of individual
39 The former is more complex and policy-independent, but less
40 performance-sensitive.  The latter is simpler and needs to be very fast.
42 Therefore, we perform per-packet integrity and privacy protection in the
50 to talk to a custom daemon called rpc.svcgssd that is provide by the
51 nfs-utils package.
67 NFS Server New RPC Upcall Mechanism
70 The newer upcall mechanism uses RPC over a unix socket to a daemon
71 called gss-proxy, implemented by a userspace program called Gssproxy.
73 The gss_proxy RPC protocol is currently documented `here
74 <https://fedorahosted.org/gss-proxy/wiki/ProtocolDocumentation>`_.
76 This upcall mechanism uses the kernel rpc client and connects to the gssproxy
84 legacy mechanism.  To switch to the new mechanism, gss-proxy must bind
86 /proc/net/rpc/use-gss-proxy.  If gss-proxy dies, it must repeat both
92 from /proc/net/rpc/use-gss-proxy and checking that it contains a
93 "1"--the read will block until gss-proxy has done its write to the file.