Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-)

NFS Security

NFS is a very widely-used file sharing protocol. It allows servers running nfsd and mountd to "export" entire file systems to other machines using NFS filesystem support built in to their kernels (or some other client support if they are not Linux machines). mountd keeps track of mounted file systems in /etc/mtab, and can display them with showmount. Many sites use NFS to serve home directories to users, so that no matter what machine in the cluster they login to, they will have all their home files.  There is some small amount of security allowed in exporting file systems. You can make your nfsd map the remote root user (uid=0) to the nobody user, denying them total access to the files exported. However, since individual users have access to their own (or at least the same uid) files, the remote root user can login or su to their account and have total access to their files. This is only a small hindrance to an attacker that has access to mount your remote file systems. If you must use NFS, make sure you export to only those machines that you really need to. Never export your entire root directory; export only directories you need to export.

Solaris has better NFS implementation then Linux or other commercial Unixes, although IBM AIX  implementation is not that bad. 

Recommended Links

• IBM Redbooks Securing NFS in AIX An Introduction to NFS v4 in AIX 5L Version 5.3
• Managing NFS and NIS, 2nd Edition   Chapter 15: Debugging Network Problems
• NFS (in)security administration and information clearinghouse
• Security Guide - Network File System (NFS) Security
• [Doc] NFS Security
• NFS [Ch 20 of PUIS]
• Satan
  • Tutorial - Unprivileged NFS access
  • Tutorial - Portmapper exports
• Tutorial - Unrestricted NFS export
• NetManage Tutorials
• Firewalls Mailing List Re NFS proxies