RE: NFS Over Private Network

From: Thomas Lindsay (lindsayt_at_socsci.umn.edu)
Date: 03/25/04

  • Next message: Randy Williams: "RE: NFS Over Private Network"
    Date: Wed, 24 Mar 2004 22:52:46 -0600 (CST)
    To: "Leeds, Daniel" <dleeds@amgen.com>
    
    

    To what degree does this solution *protect* the share itself? Is there a
    way to tie the server share to a given interface, or better yet, bind nfsd
    itself to a specific interface? Call me paranoid, but I don't trust the
    builtin security mechanisms of nfs too far, especially considering the
    vulnerability rates of some Solaris rpc services in recent years.

    If nfsd cannot be specifically bound to a given interface (and hence not
    bound to others), then a private network between two machines will serve
    only to prevent man-in-the-middle types of attacks but still leaves the
    data vulnerable to any attack on the nfs server itself through the public
    interfaces.

    Ideas?

    Thomas Lindsay
    UNIX systems administrator
    Social Science Research Facility
    University of Minnesota

    On Wed, 24 Mar 2004, Leeds, Daniel wrote:

    > should be simple. you can either cross connect the two machines secondary
    > interfaces or plug each interface into a seperate VLAN/switch/hub.
    >
    > setup the ip's on each machine and hosts/dns entries as needed. verify
    > connectivity via ping etc between the hosts.
    >
    > setup NFS as normal but mount via the private VLAN. so if hosta and hostb
    > are primary and hosta-priv and hostb-priv are the new private network links
    > your mount scenario would be:
    >
    > on host a: mount hostb-priv:/export /export
    > on host b: mount hosta-priv:/export /export
    >
    > etc etc etc.
    >
    > --daniel
    >
    >
    > > -----Original Message-----
    > > From: Michael Wright [mailto:cshelp@plu.edu]
    > > Sent: Wednesday, March 24, 2004 1:45 PM
    > > To: focus-sun@securityfocus.com
    > > Subject: NFS Over Private Network
    > >
    > >
    > > Hi, I have two Sun Servers (one running Solaris 8 the other
    > > Solaris 9).
    > > I would like to try and setup the machines so that I can use
    > > NFS over a
    > > private network between the two machines using their second
    > > NIC cards.
    > > Is this possible? Any information and suggestions would be greatly
    > > appreciated. Also, do I have to set anything special for the NICs as
    > > far as routing is concerned?
    > >
    > > Thanks,
    > >
    > > Michael
    > >
    > > PS: I know something like this was on the list previously, but I
    > > couldn't find any response to the question, so I'm asking again.
    > > --
    > > Michael Wright
    > > Technical Support Specialist
    > > Computer Science and Engineering
    > > email:wrightmj@plu.edu
    > > Pacific Lutheran University
    > > phone: 253-535-7408
    > > Tacoma, WA 98447-0003 fax: 253-535-8700
    > >
    >


  • Next message: Randy Williams: "RE: NFS Over Private Network"

    Relevant Pages

    • Re: Does there exist something like a networked filestorage
      ... number of machines. ... They might use NIS, NIS+, LDAP or something else for name ... BTW, you can have a "default" server for all user homes, and then specify ... etc.) to reside on specific other NFS servers. ...
      (comp.os.linux.networking)
    • Re: files disappearing from ls on NFS
      ... Hartmut Brandt wrote: ... RM>> The NFS server is a Windows 2008 server with an OpenText NFS ... RM>> works without problems to all the other FreeBSD machines. ...
      (freebsd-current)
    • Re: FreeBSD 5.3 I/O Performance / Linux 2.6.10 and dragonfly
      ... [nfs]# diskinfo -tv twed0s1d ... In the not too distant future, a file server for IMAP/POP3 front ends. ... Are there better benchmarks / methods of testing that would give a more ... I was just going to run postmark on the 3 clients machines ...
      (freebsd-performance)
    • Re: NFS stalling on 8.1-STABLE
      ... or thousands of nfs server not responding / is alive again messages. ... This has only started happening since I upgraded the client machines ... All nics involved are gigabit em cards, and they are on a private ...
      (freebsd-stable)
    • Re: Make complains "warning: Clock skew detected." on NFS client
      ... the time on the NFS server was set with a ... cron job ever hour, using ntpdate. ... I did the same on the NFS client (previously the clock on this was not ... The two machines have ms differences between them - NTP is not perfect. ...
      (comp.unix.solaris)