Shared Secret Key Authentication And Encryption - Revision history

Elliswilson at 15:13, 12 October 2026

2026-10-12T15:13:30Z

← Older revision		Revision as of 08:13, 12 October 2026
Line 1:		Line 1:
			{\| class='wikitable'
			\|-
			!This page collects background and original design references for Shared-Secret Key (SSK) security. For current setup instructions, see [[Lustre Kerberos SSK Authentication]] and the ''Configuring Shared-Secret Key (SSK) Security'' chapter of the [https://doc.lustre.org/lustre_manual.xhtml Lustre Operations Manual].
			\|}

	=== Introduction ===		=== Introduction ===

	Shared Key offers		Shared Key, added in Lustre 2.9 ([https://jira.whamcloud.com/browse/LU-3289 LU-3289]), offers:

	* Isolation		* Isolation (all SSK flavors)
	** Prevents clients from mounting without the shared key		** Prevents clients from mounting without the shared key
	** ~~Group and isolate~~ NID ranges ~~to a specific key~~ (with [[UID/GID_Mapping\|UID/GID Mapping]])		** Binds a key to a nodemap, so it is accepted only from that nodemap's NID ranges (with [[UID/GID_Mapping\|UID/GID Mapping]])

	* Message Integrity		* Message Integrity (<code>ska</code>, <code>ski</code>, <code>skpi</code>)
	** Prevents man-in-the-middle attacks		** Prevents man-in-the-middle attacks
	** ~~Ensure~~ RPCs cannot be altered without detection		** Ensures RPCs cannot be altered without detection. <code>ska</code> covers only non-bulk RPCs; <code>ski</code> and <code>skpi</code> also cover bulk data.

	* Privacy		* Privacy (<code>skpi</code> only)
	** Prevents eavesdropping		** Prevents eavesdropping
	** ~~Encryption of~~ RPCs		** Encrypts RPCs and bulk data

	* Ability to choose security flavors between OSS, MDS, MGS, and client nodes, as site policy dictates		* Ability to choose security flavors between OSS, MDS, MGS, and client nodes, as site policy dictates

	== Resources ==		== Resources ==
	* [https://jira.~~hpdd.intel~~.com/browse/LU-3289 IU Shared Secret Key authentication and encryption (LU-3289)]		* [https://jira.whamcloud.com/browse/LU-3289 IU Shared Secret Key authentication and encryption (LU-3289)]
	* ~~[http://wiki.opensfs.org/Contract_SFS-DEV-002~~ OpenSFS Contract SFS-DEV-002]		* The original OpenSFS Contract SFS-DEV-002 design documents (Shared Key Scope, Architecture, High Level Design, RPC Diagram, and Kerberos Setup Guide) were previously hosted on wiki.opensfs.org but are no longer available online.
	** [http://wiki.opensfs.org/File:Shared_keys_scope_v2.pdf Shared Key Scope ~~v2]~~		* For current setup instructions, see [[Lustre Kerberos SSK Authentication]]. For the reference, see the ''Configuring Shared-Secret Key (SSK) Security'' chapter of the [https://doc.lustre.org/lustre_manual.xhtml Lustre Operations Manual].
	** [http://wiki.opensfs.org~~/File:Shared_keys_architecture~~.~~pdf Shared Key Architecture]~~
	** [~~http://wiki~~.~~opensfs.org/File:Shared_keys_HLD.docx~~ Shared Key ~~High Level Design]~~
	** [~~http~~://~~wiki~~.~~opensfs~~.org/~~File:Shared_keys_RPC_diagram~~.~~pdf Shared Key RPC Diagram~~]
	** [http://wiki.~~opensfs.org/File:Kerberos_setup_guide.pdf Kerberos Setup Guide]~~

	== Presentations ==		== Presentations ==
Line 31:		Line 32:

	[[Category:Features]]		[[Category:Features]]
			[[Category:Security]]

KenRawlings: adding opensfs contract resources section

2016-06-29T19:40:31Z

adding opensfs contract resources section

← Older revision		Revision as of 12:40, 29 June 2016
Line 19:		Line 19:
	== Resources ==		== Resources ==
	* [https://jira.hpdd.intel.com/browse/LU-3289 IU Shared Secret Key authentication and encryption (LU-3289)]		* [https://jira.hpdd.intel.com/browse/LU-3289 IU Shared Secret Key authentication and encryption (LU-3289)]
			* [http://wiki.opensfs.org/Contract_SFS-DEV-002 OpenSFS Contract SFS-DEV-002]
			** [http://wiki.opensfs.org/File:Shared_keys_scope_v2.pdf Shared Key Scope v2]
			** [http://wiki.opensfs.org/File:Shared_keys_architecture.pdf Shared Key Architecture]
			** [http://wiki.opensfs.org/File:Shared_keys_HLD.docx Shared Key High Level Design]
			** [http://wiki.opensfs.org/File:Shared_keys_RPC_diagram.pdf Shared Key RPC Diagram]
			** [http://wiki.opensfs.org/File:Kerberos_setup_guide.pdf Kerberos Setup Guide]

	== Presentations ==		== Presentations ==

KenRawlings: initial creation

2016-06-29T15:36:11Z

initial creation

New page

=== Introduction ===

Shared Key offers

* Isolation
** Prevents clients from mounting without the shared key
** Group and isolate NID ranges to a specific key (with [[UID/GID_Mapping|UID/GID Mapping]])

* Message Integrity
** Prevents man-in-the-middle attacks
** Ensure RPCs cannot be altered without detection

* Privacy
** Prevents eavesdropping
** Encryption of RPCs

* Ability to choose security flavors between OSS, MDS, MGS, and client nodes, as site policy dictates

== Resources ==
* [https://jira.hpdd.intel.com/browse/LU-3289 IU Shared Secret Key authentication and encryption (LU-3289)]

== Presentations ==
* [http://lustre.ornl.gov/ecosystem-2016/documents/tutorials/Simms-IU-NodemapSharedKey.pdf Securing Lustre with Nodemap and Shared Key (Lustre Ecosystem 2016)]
* [http://cdn.opensfs.org/wp-content/uploads/2015/04/GSS-Shard-key-Update-and-Using-UID_Simms.pdf Using UID Mapping in Lustre 2.7 and GSS Shared Key Update (LUG 2015)]

[[Category:Features]]