Securing NFS on Linux: Introducing RPC-with-TLS

In 2014 the IETF published a document entitled "Pervasive Monitoring Is an Attack" [RFC7258], which recognized that unauthorized observation of network traffic had become widespread and was a subversive threat to all who make use of the Internet at large. NFS, the Internet standard file system protocol, has supported the GSS Kerberos privacy service for decades. However, Kerberos is challenging to deploy and exacts a performance tax that is onerous. Enter RPC-with-TLS, specified by RFC 9289. Chuck will introduce the concepts and rationale, and answer questions about the Linux implementation. This is not a how-to, but rather a walk through of the components, motivation, and coming features for this new on-the-wire authentication and encryption mechanism. Speaker Bio: I'm a Linux kernel maintainer specializing in network file systems and high-performance storage protocols, with deep expertise in NFS and RDMA. My work focuses on the low-level infrastructure that enterprise and cloud storage depends on--from kernel implementation to published standards. Timing: 7:00--7:45 Social Session7:45--8:00 Announcements & Introductions8:00-ish Presentation