gssd: check HOSTNAME$@REALM as well?

[Timo Aaltonen]

Hi!

There was a patch proposed some time ago to add a new option to feed the
name of the machine principal to gssd to make it work on an AD realm
without the need to create nfs/* service principals on the KDC. The
downside of the patch is that it doesn't scale that well, since you still
need to give the parameter, and the principal name is different for
every host.

The better way to handle it would be to test HOSTNAME$@REALM in the code,
probably before {root,nfs,host}/$fqdn (like on that old patch), since
otherwise host/ will match and bail out from find_keytab_entry().

The hostname and realm need to be capitalized, so it needs a new
function. Should I come up with a patch or is this something that has been
discussed already and shot down? :)

[Timo Aaltonen]

Post by Timo Aaltonen
Hi!
There was a patch proposed some time ago to add a new option to feed the
name of the machine principal to gssd to make it work on an AD realm without
the need to create nfs/* service principals on the KDC. The downside of the
patch is that it doesn't scale that well, since you still need to give the
parameter, and the principal name is different for every host.
probably before {root,nfs,host}/$fqdn (like on that old patch), since
otherwise host/ will match and bail out from find_keytab_entry().
The hostname and realm need to be capitalized, so it needs a new function.
Should I come up with a patch or is this something that has been discussed
already and shot down? :)

Meh, no need to uppercase the realm, since it's uppercase already.

Anyway, attached a patch that works for me. It's against 1.2.0 though,
haven't tested if it applies on top of master. There are probably some
issues still, I'm not that familiar with C :)
--
Timo Aaltonen
Systems Specialist
IT Services, Aalto University
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gssd.diff
Type: text/x-diff
Size: 2266 bytes
Desc:
Url : http://linux-nfs.org/pipermail/nfsv4/attachments/20100422/e3cd4535/attachment.bin

[Timo Aaltonen]

Post by Timo Aaltonen

Post by Timo Aaltonen
Hi!
There was a patch proposed some time ago to add a new option to feed the
name of the machine principal to gssd to make it work on an AD realm
without the need to create nfs/* service principals on the KDC. The
downside of the patch is that it doesn't scale that well, since you still
need to give the parameter, and the principal name is different for every
host.
probably before {root,nfs,host}/$fqdn (like on that old patch), since
otherwise host/ will match and bail out from find_keytab_entry().
The hostname and realm need to be capitalized, so it needs a new function.
Should I come up with a patch or is this something that has been discussed
already and shot down? :)

Meh, no need to uppercase the realm, since it's uppercase already.
Anyway, attached a patch that works for me. It's against 1.2.0 though,
haven't tested if it applies on top of master. There are probably some issues
still, I'm not that familiar with C :)

and here's a slightly better version..
--
Timo Aaltonen
Systems Specialist
IT Services, Aalto University
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gssd.diff
Type: text/x-diff
Size: 2401 bytes
Desc:
Url : http://linux-nfs.org/pipermail/nfsv4/attachments/20100422/0fbeaa0d/attachment.bin

[Steve Dickson]

Post by Timo Aaltonen

Post by Timo Aaltonen

Post by Timo Aaltonen
Hi!
There was a patch proposed some time ago to add a new option to feed
the name of the machine principal to gssd to make it work on an AD
realm without the need to create nfs/* service principals on the KDC.
The downside of the patch is that it doesn't scale that well, since
you still need to give the parameter, and the principal name is
different for every host.
code, probably before {root,nfs,host}/$fqdn (like on that old patch),
since otherwise host/ will match and bail out from find_keytab_entry().
The hostname and realm need to be capitalized, so it needs a new
function. Should I come up with a patch or is this something that has
been discussed already and shot down? :)

Meh, no need to uppercase the realm, since it's uppercase already.
Anyway, attached a patch that works for me. It's against 1.2.0 though,
haven't tested if it applies on top of master. There are probably some
issues still, I'm not that familiar with C :)

and here's a slightly better version..

Could you please repost this with a proper Sign-off and
a patch description that explains what the patch does and
why its needed... ala http://www.kernel.org/pub/linux/docs/lkml/#s1-10

tia,

steved.