RE: NFS Over Private Network

From: Small, Jim (jim.small_at_eds.com)
Date: 03/25/04

  • Next message: Simon Thornton: "RE: NFS Over Private Network" 
    To: focus-sun@securityfocus.com
Date: Thu, 25 Mar 2004 15:36:08 -0500

    You can use Kerberos for authentication and even encryption of the NFS
    shares. NFSv4 which is in Solaris 10 will vastly improve NFS security and
    standardization (also in Linux Kernel 2.6).

    <> Jim

    > -----Original Message-----
    > From: Thomas Lindsay [mailto:lindsayt@socsci.umn.edu]
    > Sent: Wednesday, March 24, 2004 11:53 PM
    > To: Leeds, Daniel
    > Cc: 'Michael Wright'; focus-sun@securityfocus.com
    > Subject: RE: NFS Over Private Network
    >
    >
    > To what degree does this solution *protect* the share itself? Is there a
    > way to tie the server share to a given interface, or better yet, bind nfsd
    > itself to a specific interface? Call me paranoid, but I don't trust the
    > builtin security mechanisms of nfs too far, especially considering the
    > vulnerability rates of some Solaris rpc services in recent years.
    >
    > If nfsd cannot be specifically bound to a given interface (and hence not
    > bound to others), then a private network between two machines will serve
    > only to prevent man-in-the-middle types of attacks but still leaves the
    > data vulnerable to any attack on the nfs server itself through the public
    > interfaces.
    >
    > Ideas?
    >
    > Thomas Lindsay
    > UNIX systems administrator
    > Social Science Research Facility
    > University of Minnesota
    >
    > On Wed, 24 Mar 2004, Leeds, Daniel wrote:
    >
    > > should be simple. you can either cross connect the two machines
    > secondary
    > > interfaces or plug each interface into a seperate VLAN/switch/hub.
    > >
    > > setup the ip's on each machine and hosts/dns entries as needed. verify
    > > connectivity via ping etc between the hosts.
    > >
    > > setup NFS as normal but mount via the private VLAN. so if hosta and
    > hostb
    > > are primary and hosta-priv and hostb-priv are the new private network
    > links
    > > your mount scenario would be:
    > >
    > > on host a: mount hostb-priv:/export /export
    > > on host b: mount hosta-priv:/export /export
    > >
    > > etc etc etc.
    > >
    > > --daniel
    > >
    > >
    > > > -----Original Message-----
    > > > From: Michael Wright [mailto:cshelp@plu.edu]
    > > > Sent: Wednesday, March 24, 2004 1:45 PM
    > > > To: focus-sun@securityfocus.com
    > > > Subject: NFS Over Private Network
    > > >
    > > >
    > > > Hi, I have two Sun Servers (one running Solaris 8 the other
    > > > Solaris 9).
    > > > I would like to try and setup the machines so that I can use
    > > > NFS over a
    > > > private network between the two machines using their second
    > > > NIC cards.
    > > > Is this possible? Any information and suggestions would be greatly
    > > > appreciated. Also, do I have to set anything special for the NICs as
    > > > far as routing is concerned?
    > > >
    > > > Thanks,
    > > >
    > > > Michael
    > > >
    > > > PS: I know something like this was on the list previously, but I
    > > > couldn't find any response to the question, so I'm asking again.
    > > > --
    > > > Michael Wright
    > > > Technical Support Specialist
    > > > Computer Science and Engineering
    > > > email:wrightmj@plu.edu
    > > > Pacific Lutheran University
    > > > phone: 253-535-7408
    > > > Tacoma, WA 98447-0003 fax: 253-535-8700
    > > >
    > >

  • Next message: Simon Thornton: "RE: NFS Over Private Network"

    Relevant Pages

    • Re: RFC 1037 NFILE implementations around?
      ... woefully short of RAM but with a fast network interface. ... (Rainer's comment about NFS being faster than LMFS on Symbolics ... you can think of the SUN as a networked I/O coprocessor. ... is faster over the network than on the local Lisp Machine ...
      (comp.lang.lisp)
    • Re: [Q] giving priority to network interfaces?
      ... The second interface connects the Ultra to ... > NFS server is in kernel-space. ... In 5.8 NFS runs in the kernel in the SYS class at priority 60 (lowest ...
      (comp.unix.solaris)
    • problems with jumpstart
      ... Attempting to configure interface bge3... ... NFS server MS-bckqro1 not responding still trying ... server1 -> client-install NFS R LOOKUP3 No such file or directory ...
      (SunManagers)
    • RE: NFS Over Private Network
      ... way to tie the server share to a given interface, or better yet, bind nfsd ... then a private network between two machines will serve ... data vulnerable to any attack on the nfs server itself through the public ...
      (Focus-SUN)
    • Re: Help with IPchains
      ... Do you have the resources to put the users who are mounting NFS home ... > and restart ipchains, and it goes right it..This part i ... For the input and output chains, the rules apply to every interface on the ...
      (Security-Basics)