[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: NFS security



Hey Ken,

Your not far off the mark with your estimation of nsf and security it's not a great situation.  There are a couple of tricks you can use to help secure it though.  First using rootsquash on the server export will prevent anyone trying to mount the share with root permissions or more precisely to create files on the share owned as root.  Any share is generally considered a non-secure data zone and I wouldn't recommend running files from a share as root without first really checking them over.  The other more interesting little way to do this is to install openvpn server on either your NFS server or another server and then have all the NFS clients authenticate with keys into the vpn network (say little private subnet 192.168.128.0) and only allow exports from your little private vpn subnet which is subsequently only routable through tun0 or something like that.  There are of course other linux network file systems such as samba (yeah it works pretty well on pure linux systems), coda, NCP (not sure if this is even still around), AFS and I'm sure there are ones I'm forgeting right now.  Hope this helps. 

Bobkat


From: Ken Keefe <kjkeefe@gmail.com>
To: silug-discuss@silug.org
Sent: Friday, December 19, 2008 1:08:59 PM
Subject: NFS security

Hello all. I just recently set up my first NFS share between several PC's. I'd read about it, seen it in action, but never done it myself. The setup I did was a very vanilla (I think) configuration. However, I was wondering about how systems like this are secured. It seems to me that the only protection in place is that NFS limits the various exports by IP address. However, this could easily be circumvented by someone sniffing packets on a network and then setting their IP to one of the permitted IP's in order to gain access. This also seems pretty dangerous given how file ownership is managed across NFS shares. It is not hard to imagine how a would-be attacker could become root on their local machine and copy some files over to the server that allowed them to later become root on that server.

So, I've probably hashed over a bunch of stuff you already knew. My questions are: How do you accomplish filesystem sharing in a homogenous linux environment? If you use NFS, how can you secure it from the weaknesses I mentioned?

Any advice you have would be most appreciated as I have been tasked with building a little workgroup of linux machines that share disk space on a linux server and I want to do the right thing security-wise.

Thanks!
Ken

--
Forti et Fideli nihil difficile – Nothing is difficult to the brave and faithful.