Re: nis : how to avoid user1 becoming user2 using local root ?

From: Mike Hogsett (hogsett_at_csl.sri.com)
Date: 04/01/04

  • Next message: cookie: "Re: iptables firewall script for debian-woody, 2.4.24" 
    To: focus-linux@securityfocus.com
Date: Thu, 01 Apr 2004 10:10:48 -0800

    > to everyone. The problem is the NFS-server trusting UIDs on remote
    > computers.

    If person-1 is the only one on host-a (e.g. if there is a one to one
    mapping between the nfs client and the user) you can perform all_squashing
    and anonuid and anongid mapping.

    See exports(5)

    /etc/exports
    ...
           /home/joe pc001(rw,all_squash,anonuid=150,anongid=100)
    ...

    So no matter what UID comes in from the NFS client the NFS server will map
    them to another user/group id. So who cares if Joe su's to Mark, from
    Joe's machine the NFS server will still treat him as Joe.

    Hope this helps.

     - Mike
     

  • Next message: cookie: "Re: iptables firewall script for debian-woody, 2.4.24"

    Relevant Pages