| Message ID | 161490464823.15291.13358214486203434566.stgit@noble (mailing list archive) |
|---|---|
| Headers | show |
| Series | nfs-utils: provide audit-logging of NFSv4 access | expand |
On 3/4/21 7:43 PM, NeilBrown wrote: > This version improves the man-pages, usage messages, etc and > adds a new feature: logging client attach/detach based on > /proc/fs/nfsd/clients/ > That feature is in patch 7 and should be considered RFC at this point. > i.e. patches 1-6 are ready to apply, patch 7 isn't. > > A problem with patch7 is double-reporting due to the extra transient > entries in the clients directory. I'm wondering if we could add a > "Confirmed: Y" line for confirmed clients, so that the code could > ignore any clients which are not confirmed. > Maybe those clients should just not appear, but I'd like something > that will not produce noise on old kernels, and I'm happy if it > doesn't produce any log messages without a backport of a small > kernel patch. > > Comments? Thank you for going the extra mile! Series Committed... (tag: nfs-utils-2-5-4-rc1) steved. > > V2 series comment: > > V1 of this series didn't update the usage() message for mountd, > and omited the required ':' after the 'T' sort-option. This > series fixes those two omissions. > > Original series comment: > > When NFSv3 is used mountd provides logs of successful and failed mount > attempts which can be used for auditing. > When NFSv4 is used there are no such logs as NFSv4 does not have a > distinct "mount" request. > > However mountd still knows about which filesysytems are being accessed > from which clients, and can actually provide more reliable logs than it > currently does, though they must be more verbose - with periodic "is > being accessed" message replacing a single "was mounted" message. > > This series adds support for that logging, and adds some related > improvements to make the logs as useful as possible. > > NeilBrown > > --- > > NeilBrown (7): > mountd: reject unknown client IP when !use_ipaddr. > mountd: Don't proactively add export info when fh info is requested. > mountd/exports: update man page > mountd: add logging for authentication results for accesses. > mountd: add --cache-use-ipaddr option to force use_ipaddr > mountd: make default ttl settable by option > mountd: add logging of NFSv4 clients attaching and detaching. > > > nfs.conf | 4 + > support/export/Makefile.am | 3 +- > support/export/auth.c | 4 + > support/export/cache.c | 41 +++++---- > support/export/export.h | 9 +- > support/export/v4clients.c | 177 +++++++++++++++++++++++++++++++++++++ > support/export/v4root.c | 3 +- > support/include/exportfs.h | 3 +- > support/nfs/exports.c | 4 +- > systemd/nfs.conf.man | 20 +++++ > utils/exportd/exportd.c | 42 +++++++-- > utils/exportd/exportd.man | 94 ++++++++++++++------ > utils/mountd/mountd.c | 32 ++++++- > utils/mountd/mountd.h | 5 -- > utils/mountd/mountd.man | 98 ++++++++++++++++---- > utils/mountd/svc_run.c | 5 +- > 16 files changed, 464 insertions(+), 80 deletions(-) > create mode 100644 support/export/v4clients.c > > -- > Signature >
This version improves the man-pages, usage messages, etc and adds a new feature: logging client attach/detach based on /proc/fs/nfsd/clients/ That feature is in patch 7 and should be considered RFC at this point. i.e. patches 1-6 are ready to apply, patch 7 isn't. A problem with patch7 is double-reporting due to the extra transient entries in the clients directory. I'm wondering if we could add a "Confirmed: Y" line for confirmed clients, so that the code could ignore any clients which are not confirmed. Maybe those clients should just not appear, but I'd like something that will not produce noise on old kernels, and I'm happy if it doesn't produce any log messages without a backport of a small kernel patch. Comments? V2 series comment: V1 of this series didn't update the usage() message for mountd, and omited the required ':' after the 'T' sort-option. This series fixes those two omissions. Original series comment: When NFSv3 is used mountd provides logs of successful and failed mount attempts which can be used for auditing. When NFSv4 is used there are no such logs as NFSv4 does not have a distinct "mount" request. However mountd still knows about which filesysytems are being accessed from which clients, and can actually provide more reliable logs than it currently does, though they must be more verbose - with periodic "is being accessed" message replacing a single "was mounted" message. This series adds support for that logging, and adds some related improvements to make the logs as useful as possible. NeilBrown --- NeilBrown (7): mountd: reject unknown client IP when !use_ipaddr. mountd: Don't proactively add export info when fh info is requested. mountd/exports: update man page mountd: add logging for authentication results for accesses. mountd: add --cache-use-ipaddr option to force use_ipaddr mountd: make default ttl settable by option mountd: add logging of NFSv4 clients attaching and detaching. nfs.conf | 4 + support/export/Makefile.am | 3 +- support/export/auth.c | 4 + support/export/cache.c | 41 +++++---- support/export/export.h | 9 +- support/export/v4clients.c | 177 +++++++++++++++++++++++++++++++++++++ support/export/v4root.c | 3 +- support/include/exportfs.h | 3 +- support/nfs/exports.c | 4 +- systemd/nfs.conf.man | 20 +++++ utils/exportd/exportd.c | 42 +++++++-- utils/exportd/exportd.man | 94 ++++++++++++++------ utils/mountd/mountd.c | 32 ++++++- utils/mountd/mountd.h | 5 -- utils/mountd/mountd.man | 98 ++++++++++++++++---- utils/mountd/svc_run.c | 5 +- 16 files changed, 464 insertions(+), 80 deletions(-) create mode 100644 support/export/v4clients.c -- Signature