[Gluster-users] Secured mount in GlusterFS using keys

[Deepak Naidu]

Hi Joe, thanks for taking time for explaining. I am having basic set of requirements along with IO performance as key factor, my reply below should justify what I am trying to achieve.

>>If I am understanding your use case properly, you want to ensure that a client may only mount a gluster volume if and only if it presents a key or secret that attests to the client's identity, which the gluster server can use to verify that client's identity. 

Yes, this is the exact use case for my requirements.



>>That's exactly what gluster MTLS is doing since the gluster server performs chain-of-trust validation on the client's leaf certificate.

That's good, but my confusion here is does this MTLS also encrypt's IO traffic like TLS. If yes, than it's not want I am looking for. The reason is the IO encryption/decryption is an extra overhead for my use case as performance of IO is also factor why we're are looking for GlusterFS, unless my understanding is incorrect that IO encryption has no overhead.



>> I don't understand why I/O path encryption is something you want to avoid -- seems like an essential part of basic network security that you get for "free" with the authentication. 

If I understand the term IO path encryption correctly, all the storage IO will go through extra latency of encryption & decryption which is not needed for my requirements as this produced extra IO latency which is why I am trying to avoid IO path encryption & just need basic secret based authentication.




--
Deepak

> On Mar 18, 2017, at 10:46 AM, Joseph Lorenzini <jaloren at gmail.com> wrote:
> 
> I am little confused about what you are trying to accomplish here. If I am understanding your use case properly, you want to ensure that a client may only mount a gluster volume if and only if it presents a key or secret that attests to the client's identity, which the gluster server can use to verify that client's identity. That's exactly what gluster MTLS is doing since the gluster server performs chain-of-trust validation on the client's leaf certificate.
> 
> Of course this will necessarily force encryption of the I/O path since its TLS. I don't understand why I/O path encryption is something you want to avoid -- seems like an essential part of basic network security that you get for "free" with the authentication. It is true that if you want the key-based authentication of a gluster client, you will need gluster MTLS. You could treat encryption as the "cost" of getting authentication if you will.
> 
> Now I am personally pretty negative on X.509 and chain-of-trust in general, since the trust model has been proven to not scale and is frequently broken by malicious and incompetent CAs. I also think its a completely inappropriate security model for something like gluster where all endpoints are known and controlled by a single entity, forcing a massive amount of unnecessary complexity with certificate management with no real added security. I have thought about making a feature request that gluster support a simple public-key encryption that's implemented like SSH. But all that said, MTLS is a well-tested, well known security protocol and the gluster team built it on top of openssl so it does get the security job done in an acceptable way. The fact that the I/O path is encrypted is not the thing that bothers me about the implementation though.
-----------------------------------------------------------------------------------
This email message is for the sole use of the intended recipient(s) and may contain
confidential information.  Any unauthorized review, use, disclosure or distribution
is prohibited.  If you are not the intended recipient, please contact the sender by
reply email and destroy all copies of the original message.
-----------------------------------------------------------------------------------