gss-proxy.git/proxy/examples, branch ntlmssp

Add option to specify allowed usage.

2013-10-18T13:46:24+00:00

Credentials can often be used both to accept and to initiate contexts.
With this option admins can allow a specific usage only.
This is to avoid allowing an unprivileged process to fool a remote
client by allowing it to impersonate a server, when we only want to
allow this service to use credentials to initiate contexts.

Reviewed-by: Günther Deschner

Allow arbitrary users to connect to a service

2013-10-18T13:46:24+00:00

The rpc.gssd daemon is changing to fork and change uid to the unprivileged
user it wants to authenticate, this means gssproxy needs to allow connection
from any euid. When this is done though, the trusted flag needs to be dropped,
if the connecting euid does not match the default trusted uid to prevent
improper impersonation.

Resolves: https://fedorahosted.org/gss-proxy/ticket/103
Reviewed-by: Günther Deschner

Split nfs server and client services

2013-06-21T14:26:38+00:00

The NFS server uses a special socket for the kernel communication.
Split configuration in 2 distinct services so we can use specific options that
may be different between server and client.

The 3 main differences so far are:
1. socket: default for client, custom for server
2. kernel_nfd option only for server
3. ccache and client keytab options only for client

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Fix nfsd socket

2013-06-06T14:51:16+00:00

The Kernel expect the knfsd socket in a specific plce that is not where
our standard socket is created.
Add a knfsd specific socket in the default configuration.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner 

Resolves: https://fedorahosted.org/gss-proxy/ticket/93

Add --with-gpstate-path=PATH configure switch.

2013-05-06T13:00:10+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Improve default configuration.

2013-04-23T19:02:45+00:00

Install by default working nfs configuration.
For RPM also install by default file to configure interposer plugin.

Signed-off-by: Simo Sorce 
Reviewed-by: Günther Deschner

Make socket path a configure option

2013-03-22T15:34:37+00:00

The kernel uses the fixed path named /var/run/gssproxy.sock
Make this default a configure time option and default to it.
Also remove the option to change the socket at configure time,
neither the kernel nor proxymech.so can cope with a change anyway.

Enable kernel support.

2013-03-22T15:34:32+00:00

The Linux kernel now requires the gss-proxy to signal when it is available.
This is done by writing 1 to the file /proc/net/rpc/use-gss-proxy

Once this happens the kernel will try to attach to the gss-proxy socket
and use it instead of the classic rpc.svcgssd daemon.

Add example GSS-API mechanism plugins config file.

2013-01-15T15:02:34+00:00

The file is not installed automatically yet.

config: Rework configuration syntax

2012-04-05T15:20:33+00:00

Keeping 2 separate sections for credentials and services seem to just make
things really confusing. The off chance of reusing a 'credential' section is
dwarfed by the confusion cause by keeping them separate. Having to copy a full
service section is not a big deal so KISS wins here.