3 ms·
NFS has -o sec=krb5p which uses Kerberos principles, which can be mapped to accounts server side. Additionally, the the traffic is encrypted. OpenAFS also use
by mattpallissard 3y ago
NFS has -o sec=krb5p which uses Kerberos principles, which can be mapped to accounts server side. Additionally, the the traffic is encrypted.
OpenAFS also uses kerberos for auth, but has a separate 'aklog' for AFS tokens on top of that. It also solved permissions in an interesting way by completely foregoing OS permissions. This allowed them to have more fine grained than POSIX specified and made the permissions identical across platforms.
- philsnow 3y agoInteresting; in a past life my school actually used AFS and had competent admins for it, and the experience was good (although I stayed very much “on the beaten path”). It seems like a bit more of a lift to go with Kerberos than even using something like LDAP in my home network for user provisioning. My whole screed above comes from reluctance to set up freeIPA.
- mattpallissard 3y agoThat sounds about right, its roots are education and research. Hence the strong federation support. If you do decide to go down the krb route (I highly recommend), skip free IPA and just run vanilla openldap and MIT Kerberos. It's one of those things that has a learning curve, but mostly just runs itself after that.