Exporting an NFS share for Kerberos authentication
Kerberos provides three types of security options for exporting an NFS share:
krb5
krb5i
krb5p
Access Appliance also provides a sys (sec=sys) export option, which does not provide Kerberos authentication. Access Appliance supports all of the three types of Kerberos security options. All of the security options use Kerberos V5 to authenticate users to NFS servers.
krb5i computes a hash on every remote procedure (RPC) call request to the server and every response to the client. The hash is computed on an entire message: RPC header, plus NFS arguments or results. Since the hash information travels with the NFS packet, any attacker modifying the data in the packet can be detected. Thus krb5i provides integrity protection.
krb5p uses encryption to provide privacy. With krb5p, NFS arguments and results are encrypted, so a malicious attacker cannot spoof on the NFS packets and see file data or metadata.
Note:
Since krb5i and krb5p perform an additional set of computations on each NFS packet, NFS performance decreases as compared with krb5.
Performance decreases in the following order: krb5 > krb5i > krb5p.
krb5 provides better performance and krb5p gives the least performance.
Additional export options are available.
See Exporting an NFS share .
To export a directory using only the krb5 mount option
- Export a directory using only the krb5 mount option:
NFS> share add sec=krb5 /vx/fs1 share1 client1 Exporting /vx/fs1 with options sec=krb5 Success.
If the client name is not mentioned while creating the share, the default value is * .
To export a directory using krb5, krb5i, krb5p, and sys options
- Export a directory using krb5, krb5i, krb5p, and sys options.
NFS> share add sec=krb5:krb5i:krb5p:sys /vx/fs1 share1 client1 Exporting /vx/fs1 with options sec=krb5:krb5i:krb5p:sys Success.
If the client name is not mentioned while creating the share, the default value is * .
Different clients can use different levels of security in this case. Client A can mount with krb5, and client B can mount with krb5p. If no mount option is given at the client side, security to be chosen is negotiated, and the highest level of security is chosen. In this case, it is krb5p.