ganesha-tls-config - Man Page

/etc/ganesha/ganesha.conf

Transport Layer Security (TLS) is a cryptographic protocol that provides confidentiality, integrity, and authentication for network communications. When used with NFS, TLS encrypts all traffic between the client and server, ensuring that data is not visible to intermediaries and that it cannot be altered in transit without detection.

TLS operates at the transport layer (above TCP) and establishes a secure channel between the client and server before any application data is exchanged. During the handshake process, the client validates the server's identity using its certificate. The server may also optionally request a certificate from the client.

When NFS is configured to use TLS-based transport security, the mount negotiation and all subsequent RPC calls are carried over this encrypted channel.

TLS VS. MTLS In standard TLS (also called one-way TLS), only the server is authenticated. The client verifies that it is talking to the correct server by validating the server's certificate against a trusted Certificate Authority (CA). The server does not verify the client's identity beyond the network address and any application-level authentication.

In mutual TLS (mTLS), both endpoints present certificates during the TLS handshake. The client still validates the server's certificate, but the server also validates the client's certificate against its own trusted CA list. This provides stronger assurance that the client is an authorized entity, not just any host on the network. A client certificate signed by a trusted CA is required. This mode is used where unauthorized clients must be blocked before any data exchange occurs.

Below are the ways by which client can initiate NFS over TLS connection while mounting:

Example 1: Stunnel (Install stunnel)

1. Configure stunnel with forwarding port to ganesha configured port.

   Example config file (/etc/stunnel/stunnel.conf):

   pid = /var/run/stunnel/stunnel.pid
   cert = /home/dpp/workspace/TLS_ceritificates/vm1.crt
   key = /home/dpp/workspace/TLS_ceritificates/vm1.key
   CAfile = /home/dpp/workspace/TLS_ceritificates/ca.crt
   socket = r:TCP_NODELAY=1
   foreground = yes
   debug = 7
   output = /var/log/stunnel.log
   renegotiation = no
   
   [nfs4]
   client = yes
   accept = 127.0.0.1:49152
   connect = 23.13.161.10:2049
   sslVersion = TLSv1.3
   ciphers = ALL
   verify = 2
   # change above verify = 2 for tls and mtls accordingly.

2. Start stunnel

3. Mount using below command:

   mount -vv -t nfs -o rw -o port=49152 127.0.0.1:/exportfs0 /mnt/

Example 2: Use the tlshd (Install ktls-utils)

1. Configure /etc/tlshd.conf
2. Start tlshd

3. Mount command:

   mount -vv -t nfs -o vers=4 -o xprtsec=mtls -o rw 104.86.87.87:/exportfs0/ /mnt

ganesha-config <>(8)