RE: NFS Over Private Network

• Previous message: Small, Jim: "RE: NFS Over Private Network"
• In reply to: Michael Wright: "NFS Over Private Network"
• Next in thread: Erek Adams: "RE: NFS Over Private Network"
• Reply: Erek Adams: "RE: NFS Over Private Network"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Thu, 25 Mar 2004 10:19:01 +0100
To: "'Michael Wright'" <cshelp@plu.edu>, focus-sun@securityfocus.com

Hi Michael,

At the least I would replace the SUN portmapper with the one from the
TCPwrappers suite. This will allow you to restrict access
(/etc/hosts.allow) on the IP level to portmap and therefore to some
services. For the NIC setup, use a separate subnet to the main interface
and disable IP forwarding. It should not be possible for someone on the
main network to send traffic to the private network. Some people use
IPV6 on the backend if there front end only supports IPV4.

You might also consider using a VPN tunnel or encrypt the NFS traffic
between the boxes (stunnel, cipe, ssh etc) to avoid NFS being visible on
the wire.

If all the RPC & NFS traffic is on the backend segment and no IP
forwarding is permitted on the hosts, then MITM attacks on NFS, from the
front end network should not be possible.

I would consider if NFS is really necesary, wherever possible don't use
it. Maybe shared drive arrays are a better solution, they are certainly
more reliable.

Rgds,

Simon

-----Original Message-----
From: Michael Wright [mailto:cshelp@plu.edu]
Sent: Wednesday, March 24, 2004 22:45
To: focus-sun@securityfocus.com
Subject: NFS Over Private Network

Hi, I have two Sun Servers (one running Solaris 8 the other Solaris 9).

I would like to try and setup the machines so that I can use NFS over a
private network between the two machines using their second NIC cards.
Is this possible? Any information and suggestions would be greatly
appreciated. Also, do I have to set anything special for the NICs as
far as routing is concerned?

Thanks,

Michael

PS: I know something like this was on the list previously, but I
couldn't find any response to the question, so I'm asking again.

• application/x-pkcs7-signature attachment: smime.p7s

• Previous message: Small, Jim: "RE: NFS Over Private Network"
• In reply to: Michael Wright: "NFS Over Private Network"
• Next in thread: Erek Adams: "RE: NFS Over Private Network"
• Reply: Erek Adams: "RE: NFS Over Private Network"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]