7.6.2. Security
Aside from lack of multivendor support, the other problem with NFS
security flavors is that they become obsolete rather quickly. To
mitigate this, IETF specified the RPCSEC_GSS security flavor that NFS
and other RPC-based protocols could use to normalize access to
different security mechanisms. RPCSEC_GSS accomplishes this using
another IETF specification called the Generic Security Services
Application Programming Interface (GSS-API). GSS-API is an abstract
layer for generating messages that are encrypted or signed in a form
that can be sent to a peer on the network for decryption or
verification. GSS-API has been specified to work over Kerberos V5,
the Simple Public Key Mechanism, and the Low Infrastructure Public
Key system (LIPKEY). We will discuss NFS security, RPCSEC_GSS, and
Kerberos V5 in more detail in Chapter 12, "Network Security".
The Secure Socket Layer (SSL) and IPSec were considered as candidates
to provide NFS security. SSL wasn't feasible because it was
confined to connection-oriented protocols like TCP, and NFS and RPC
work over TCP and UDP. IPSec wasn't feasible because, as noted
in the section
Section 7.2.7, "NFS over TCP", NFS clients
typically don't have a TCP connection per user; whereas, it is
hard, if not impossible, for an IPSec implementation to authenticate
multiple users over a single TCP/IP
connection.