477 lines
12 KiB
HTML
477 lines
12 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of rpc.gssd</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>rpc.gssd</H1>
|
|
Section: Maintenance Commands (8)<BR>Updated: 20 Feb 2013<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
rpc.gssd - RPCSEC_GSS daemon
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>rpc.gssd</B>
|
|
|
|
[<B>-DfMnlvr</B>]
|
|
|
|
[<B>-k</B>
|
|
|
|
<I>keytab</I>]
|
|
|
|
[<B>-p</B>
|
|
|
|
<I>pipefsdir</I>]
|
|
|
|
[<B>-d</B>
|
|
|
|
<I>ccachedir</I>]
|
|
|
|
[<B>-t</B>
|
|
|
|
<I>timeout</I>]
|
|
|
|
[<B>-R</B>
|
|
|
|
<I>realm</I>]
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>INTRODUCTION</H2>
|
|
|
|
The RPCSEC_GSS protocol, defined in RFC 5403, is used to provide
|
|
strong security for RPC-based protocols such as NFS.
|
|
<P>
|
|
|
|
Before exchanging RPC requests using RPCSEC_GSS, an RPC client must
|
|
establish a GSS
|
|
<I>security context</I>.
|
|
|
|
A security context is shared state on each
|
|
end of a network transport that enables GSS-API security services.
|
|
<P>
|
|
|
|
Security contexts are established using
|
|
<I>security credentials</I>.
|
|
|
|
A credential grants temporary access to a secure network service,
|
|
much as a railway ticket grants temporary access to use a rail service.
|
|
<P>
|
|
|
|
A user typically obtains a credential by providing a password to the
|
|
<B><A HREF="/cgi-bin/man/man2html?1+kinit">kinit</A></B>(1)
|
|
|
|
command, or via a PAM library at login time.
|
|
A credential acquired with a
|
|
<I>user principal</I>
|
|
|
|
is known as a
|
|
<I>user credential</I>
|
|
|
|
(see
|
|
<B><A HREF="/cgi-bin/man/man2html?1+kerberos">kerberos</A></B>(1)
|
|
|
|
for more on principals).
|
|
<P>
|
|
|
|
For certain operations, a credential is required
|
|
which represents no user,
|
|
is otherwise unprivileged,
|
|
and is always available.
|
|
This is referred to as a
|
|
<I>machine credential</I>.
|
|
|
|
<P>
|
|
|
|
Machine credentials are typically established using a
|
|
<I>service principal</I>,
|
|
|
|
whose encrypted password, called its
|
|
<I>key</I>,
|
|
|
|
is stored in a file, called a
|
|
<I>keytab</I>,
|
|
|
|
to avoid requiring a user prompt.
|
|
A machine credential effectively does not expire because the system
|
|
can renew it as needed without user intervention.
|
|
<P>
|
|
|
|
Once obtained, credentials are typically stored in local temporary files
|
|
with well-known pathnames.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
To establish GSS security contexts using these credential files,
|
|
the Linux kernel RPC client depends on a userspace daemon called
|
|
<B>rpc.gssd</B>.
|
|
|
|
The
|
|
<B>rpc.gssd</B>
|
|
|
|
daemon uses the rpc_pipefs filesystem to communicate with the kernel.
|
|
<A NAME="lbAF"> </A>
|
|
<H3>User Credentials</H3>
|
|
|
|
When a user authenticates using a command such as
|
|
<B><A HREF="/cgi-bin/man/man2html?1+kinit">kinit</A></B>(1),
|
|
|
|
the resulting credential is stored in a file with a well-known name
|
|
constructed using the user's UID.
|
|
<P>
|
|
|
|
To interact with an NFS server
|
|
on behalf of a particular Kerberos-authenticated user,
|
|
the Linux kernel RPC client requests that
|
|
<B>rpc.gssd</B>
|
|
|
|
initialize a security context with the credential
|
|
in that user's credential file.
|
|
<P>
|
|
|
|
Typically, credential files are placed in
|
|
<I>/tmp</I>.
|
|
|
|
However,
|
|
<B>rpc.gssd</B>
|
|
|
|
can search for credential files in more than one directory.
|
|
See the description of the
|
|
<B>-d</B>
|
|
|
|
option for details.
|
|
<A NAME="lbAG"> </A>
|
|
<H3>Machine Credentials</H3>
|
|
|
|
A user credential is established by a user and
|
|
is then shared with the kernel and
|
|
<B>rpc.gssd</B>.
|
|
|
|
A machine credential is established by
|
|
<B>rpc.gssd</B>
|
|
|
|
for the kernel when there is no user.
|
|
Therefore
|
|
<B>rpc.gssd</B>
|
|
|
|
must already have the materials on hand to establish this credential
|
|
without requiring user intervention.
|
|
<P>
|
|
|
|
<B>rpc.gssd</B>
|
|
|
|
searches the local system's keytab for a principal and key to use
|
|
to establish the machine credential.
|
|
By default,
|
|
<B>rpc.gssd</B>
|
|
|
|
assumes the file
|
|
<I>/etc/krb5.keytab</I>
|
|
|
|
contains principals and keys that can be used to obtain machine credentials.
|
|
<P>
|
|
|
|
<B>rpc.gssd</B>
|
|
|
|
searches in the following order for a principal to use.
|
|
The first matching credential is used.
|
|
For the search, <hostname> and <REALM> are replaced with the local
|
|
system's hostname and Kerberos realm.
|
|
<P>
|
|
<BR> <HOSTNAME>$@<REALM>
|
|
<BR>
|
|
|
|
<BR> root/<hostname>@<REALM>
|
|
<BR>
|
|
|
|
<BR> nfs/<hostname>@<REALM>
|
|
<BR>
|
|
|
|
<BR> host/<hostname>@<REALM>
|
|
<BR>
|
|
|
|
<BR> root/<anyname>@<REALM>
|
|
<BR>
|
|
|
|
<BR> nfs/<anyname>@<REALM>
|
|
<BR>
|
|
|
|
<BR> host/<anyname>@<REALM>
|
|
<P>
|
|
The <anyname> entries match on the service name and realm, but ignore the hostname.
|
|
These can be used if a principal matching the local host's name is not found.
|
|
<P>
|
|
|
|
Note that the first principal in the search order is a user principal
|
|
that enables Kerberized NFS when the local system is joined
|
|
to an Active Directory domain using Samba.
|
|
A password for this principal must be provided in the local system's keytab.
|
|
<P>
|
|
|
|
You can specify another keytab by using the
|
|
<B>-k</B>
|
|
|
|
option if
|
|
<I>/etc/krb5.keytab</I>
|
|
|
|
does not exist or does not provide one of these principals.
|
|
<A NAME="lbAH"> </A>
|
|
<H3>Credentials for UID 0</H3>
|
|
|
|
UID 0 is a special case.
|
|
By default
|
|
<B>rpc.gssd</B>
|
|
|
|
uses the system's machine credentials for UID 0 accesses
|
|
that require GSS authentication.
|
|
This limits the privileges of the root user
|
|
when accessing network resources that require authentication.
|
|
<P>
|
|
|
|
Specify the
|
|
<B>-n</B>
|
|
|
|
option when starting
|
|
<B>rpc.gssd</B>
|
|
|
|
if you'd like to force the root user to obtain a user credential
|
|
rather than use the local system's machine credential.
|
|
<P>
|
|
|
|
When
|
|
<B>-n</B>
|
|
|
|
is specified,
|
|
the kernel continues to request a GSS context established
|
|
with a machine credential for NFSv4 operations,
|
|
such as SETCLIENTID or RENEW, that manage state.
|
|
If
|
|
<B>rpc.gssd</B>
|
|
|
|
cannot obtain a machine credential (say, the local system has
|
|
no keytab), NFSv4 operations that require machine credentials will fail.
|
|
<A NAME="lbAI"> </A>
|
|
<H3>Encryption types</H3>
|
|
|
|
A realm administrator can choose to add keys encoded in a number of different
|
|
encryption types to the local system's keytab.
|
|
For instance, a host/ principal might have keys for the
|
|
<B>aes256-cts-hmac-sha1-96</B>,
|
|
|
|
<B>aes128-cts-hmac-sha1-96</B>,
|
|
|
|
<B>des3-cbc-sha1</B>, and
|
|
|
|
<B>arcfour-hmac</B> encryption types.
|
|
|
|
This permits
|
|
<B>rpc.gssd</B>
|
|
|
|
to choose an appropriate encryption type that the target NFS server
|
|
supports.
|
|
<P>
|
|
|
|
These encryption types are stronger than legacy single-DES encryption types.
|
|
To interoperate in environments where servers support
|
|
only weak encryption types,
|
|
you can restrict your client to use only single-DES encryption types
|
|
by specifying the
|
|
<B>-l</B>
|
|
|
|
option when starting
|
|
<B>rpc.gssd</B>.
|
|
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="1"><B>-D</B>
|
|
|
|
<DD>
|
|
The server name passed to GSSAPI for authentication is normally the
|
|
name exactly as requested. e.g. for NFS
|
|
it is the server name in the "servername:/path" mount request. Only if this
|
|
servername appears to be an IP address (IPv4 or IPv6) or an
|
|
unqualified name (no dots) will a reverse DNS lookup
|
|
will be performed to get the canoncial server name.
|
|
<P>
|
|
If
|
|
<B>-D</B>
|
|
|
|
is present, a reverse DNS lookup will
|
|
<I>always</I>
|
|
|
|
be used, even if the server name looks like a canonical name. So it
|
|
is needed if partially qualified, or non canonical names are regularly
|
|
used.
|
|
<P>
|
|
Using
|
|
<B>-D</B>
|
|
|
|
can introduce a security vulnerability, so it is recommended that
|
|
<B>-D</B>
|
|
|
|
not be used, and that canonical names always be used when requesting
|
|
services.
|
|
<DT id="2"><B>-f</B>
|
|
|
|
<DD>
|
|
Runs
|
|
<B>rpc.gssd</B>
|
|
|
|
in the foreground and sends output to stderr (as opposed to syslogd)
|
|
<DT id="3"><B>-n</B>
|
|
|
|
<DD>
|
|
When specified, UID 0 is forced to obtain user credentials
|
|
which are used instead of the local system's machine credentials.
|
|
<DT id="4"><B>-k </B><I>keytab</I>
|
|
|
|
<DD>
|
|
Tells
|
|
<B>rpc.gssd</B>
|
|
|
|
to use the keys found in
|
|
<I>keytab</I>
|
|
|
|
to obtain machine credentials.
|
|
The default value is
|
|
<I>/etc/krb5.keytab</I>.
|
|
|
|
<DT id="5"><B>-l</B>
|
|
|
|
<DD>
|
|
When specified, restricts
|
|
<B>rpc.gssd</B>
|
|
|
|
to sessions to weak encryption types such as
|
|
<B>des-cbc-crc</B>.
|
|
|
|
This option is available only when the local system's Kerberos library
|
|
supports settable encryption types.
|
|
<DT id="6"><B>-p </B><I>path</I>
|
|
|
|
<DD>
|
|
Tells
|
|
<B>rpc.gssd</B>
|
|
|
|
where to look for the rpc_pipefs filesystem. The default value is
|
|
<I>/var/lib/nfs/rpc_pipefs</I>.
|
|
|
|
<DT id="7"><B>-d </B><I>search-path</I>
|
|
|
|
<DD>
|
|
This option specifies a colon separated list of directories that
|
|
<B>rpc.gssd</B>
|
|
|
|
searches for credential files. The default value is
|
|
<I>/tmp:/run/user/%U</I>.
|
|
|
|
The literal sequence "%U" can be specified to substitue the UID
|
|
of the user for whom credentials are being searched.
|
|
<DT id="8"><B>-M</B>
|
|
|
|
<DD>
|
|
By default, machine credentials are stored in files in the first
|
|
directory in the credential directory search path (see the
|
|
<B>-d</B>
|
|
|
|
option). When
|
|
<B>-M</B>
|
|
|
|
is set,
|
|
<B>rpc.gssd</B>
|
|
|
|
stores machine credentials in memory instead.
|
|
<DT id="9"><B>-v</B>
|
|
|
|
<DD>
|
|
Increases the verbosity of the output (can be specified multiple times).
|
|
<DT id="10"><B>-r</B>
|
|
|
|
<DD>
|
|
If the RPCSEC_GSS library supports setting debug level,
|
|
increases the verbosity of the output (can be specified multiple times).
|
|
<DT id="11"><B>-R </B><I>realm</I>
|
|
|
|
<DD>
|
|
Kerberos tickets from this
|
|
<I>realm</I>
|
|
|
|
will be preferred when scanning available credentials cache files to be
|
|
used to create a context. By default, the default realm, as configured
|
|
in the Kerberos configuration file, is preferred.
|
|
<DT id="12"><B>-t </B><I>timeout</I>
|
|
|
|
<DD>
|
|
Timeout, in seconds, for kernel GSS contexts. This option allows you to force
|
|
new kernel contexts to be negotiated after
|
|
<I>timeout</I>
|
|
|
|
seconds, which allows changing Kerberos tickets and identities frequently.
|
|
The default is no explicit timeout, which means the kernel context will live
|
|
the lifetime of the Kerberos service ticket used in its creation.
|
|
<DT id="13"><B>-T timeout</B>
|
|
|
|
<DD>
|
|
Timeout, in seconds, to create an RPC connection with a server while
|
|
establishing an authenticated gss context for a user.
|
|
The default timeout is set to 5 seconds.
|
|
If you get messages like "WARNING: can't create tcp rpc_clnt to server
|
|
%servername% for user with uid %uid%: RPC: Remote system error -
|
|
Connection timed out", you should consider an increase of this timeout.
|
|
</DL>
|
|
<A NAME="lbAK"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+rpc.svcgssd">rpc.svcgssd</A></B>(8),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+kerberos">kerberos</A></B>(1),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+kinit">kinit</A></B>(1),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?5+krb5.conf">krb5.conf</A></B>(5)
|
|
|
|
<A NAME="lbAL"> </A>
|
|
<H2>AUTHORS</H2>
|
|
|
|
<BR>
|
|
|
|
Dug Song <<A HREF="mailto:dugsong@umich.edu">dugsong@umich.edu</A>>
|
|
<BR>
|
|
|
|
Andy Adamson <<A HREF="mailto:andros@umich.edu">andros@umich.edu</A>>
|
|
<BR>
|
|
|
|
Marius Aamodt Eriksen <<A HREF="mailto:marius@umich.edu">marius@umich.edu</A>>
|
|
<BR>
|
|
|
|
J. Bruce Fields <<A HREF="mailto:bfields@umich.edu">bfields@umich.edu</A>>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="14"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="15"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="16"><A HREF="#lbAD">INTRODUCTION</A><DD>
|
|
<DT id="17"><A HREF="#lbAE">DESCRIPTION</A><DD>
|
|
<DL>
|
|
<DT id="18"><A HREF="#lbAF">User Credentials</A><DD>
|
|
<DT id="19"><A HREF="#lbAG">Machine Credentials</A><DD>
|
|
<DT id="20"><A HREF="#lbAH">Credentials for UID 0</A><DD>
|
|
<DT id="21"><A HREF="#lbAI">Encryption types</A><DD>
|
|
</DL>
|
|
<DT id="22"><A HREF="#lbAJ">OPTIONS</A><DD>
|
|
<DT id="23"><A HREF="#lbAK">SEE ALSO</A><DD>
|
|
<DT id="24"><A HREF="#lbAL">AUTHORS</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:12 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|