From owner-freebsd-hackers@freebsd.org  Tue Dec  1 07:51:20 2015
Return-Path: <owner-freebsd-hackers@freebsd.org>
Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 0BB01A3D46C
 for <freebsd-hackers@mailman.ysv.freebsd.org>;
 Tue,  1 Dec 2015 07:51:20 +0000 (UTC) (envelope-from slw@zxy.spb.ru)
Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org
 [IPv6:2001:1900:2254:206a::50:5])
 by mx1.freebsd.org (Postfix) with ESMTP id E47E310FE
 for <freebsd-hackers@freebsd.org>; Tue,  1 Dec 2015 07:51:19 +0000 (UTC)
 (envelope-from slw@zxy.spb.ru)
Received: by mailman.ysv.freebsd.org (Postfix)
 id E3E69A3D46A; Tue,  1 Dec 2015 07:51:19 +0000 (UTC)
Delivered-To: hackers@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id E3783A3D469
 for <hackers@mailman.ysv.freebsd.org>; Tue,  1 Dec 2015 07:51:19 +0000 (UTC)
 (envelope-from slw@zxy.spb.ru)
Received: from zxy.spb.ru (zxy.spb.ru [195.70.199.98])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 9D28810FD
 for <hackers@freebsd.org>; Tue,  1 Dec 2015 07:51:19 +0000 (UTC)
 (envelope-from slw@zxy.spb.ru)
Received: from slw by zxy.spb.ru with local (Exim 4.86 (FreeBSD))
 (envelope-from <slw@zxy.spb.ru>)
 id 1a3fiX-000NpY-DD; Tue, 01 Dec 2015 10:51:17 +0300
Date: Tue, 1 Dec 2015 10:51:17 +0300
From: Slawa Olhovchenkov <slw@zxy.spb.ru>
To: Rick Macklem <rmacklem@uoguelph.ca>
Cc: hackers@freebsd.org
Subject: Re: NFSv4 details and documentations
Message-ID: <20151201075117.GE31314@zxy.spb.ru>
References: <9BC3EFA2-945F-4C86-89F6-778873B58469@cs.huji.ac.il>
 <661673285.88370232.1447682409478.JavaMail.zimbra@uoguelph.ca>
 <20151116141433.GA31314@zxy.spb.ru>
 <1489367909.88538127.1447688459383.JavaMail.zimbra@uoguelph.ca>
 <20151116155710.GB31314@zxy.spb.ru>
 <1312967974.89238067.1447714816355.JavaMail.zimbra@uoguelph.ca>
 <20151130165940.GB31314@zxy.spb.ru>
 <183609075.112643195.1448924896262.JavaMail.zimbra@uoguelph.ca>
 <1530363546.112649399.1448925348701.JavaMail.zimbra@uoguelph.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1530363546.112649399.1448925348701.JavaMail.zimbra@uoguelph.ca>
User-Agent: Mutt/1.5.24 (2015-08-30)
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: slw@zxy.spb.ru
X-SA-Exim-Scanned: No (on zxy.spb.ru); SAEximRunCond expanded to false
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
 <freebsd-hackers.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers/>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Dec 2015 07:51:20 -0000

On Mon, Nov 30, 2015 at 06:15:48PM -0500, Rick Macklem wrote:

> In GSS, the host based principal is <some-string>@<host>.<domain>. This
> translates to:  <some-string>/<host>.<domain>@<KERBEROS-REALM> in the KDC.



> For example:
>   nfs-client.my.home - DNS name of the client machine
>   MYREALM - Realm for Kerberos KDC
>   - I want to have root work as "root".
> --> I go to the KDC and create a principal name:
>    root/nfs-client.my.home@MYREALM
>    --> Then I create a keytab entry for this principal and transfer it to
>        /etc/krb5.keytab on the client machine (nfs-client.my.home).
>    --> Then I mount with: -o nfsv4,gssname=root
>        and non-root users will have to kinit to access the server as themselves.

Is there a difference between gssname=host
(host/nfs-client.my.home@MYREALM and already exist) and gssname=root
(and create and expoprt additional root/nfs-client.my.home@MYREALM)?