Linux

Ask something
Discussion Locked

NFS security

0 helpful
10 replies

by tewfik

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

It seems that NFS has an inherent weak point when being used over a network where workstation users have root privilege on their machines.
Indeed in a situation where the home is mounted through NFS, a user may su on his machine and then su to another user they get access to that user's home without need for a password auth.
anyone knows of a workaround solution?

10 replies

by mledauphin

I don't understand what you want :
If the user has root access, he can do anything. It's what root is made for.
Ususally, nobody must have root access even to shutdown the linux box.

Hope this will help you.

by tewfik

Greetings
Thank you for your attempt at answering my question on techrepublic. You at lest let me know that maybe I didn't phrase it the right way.
You are right, root is supposed to have absolute privileges, at the level of ONE machine. Now say that we have this configuration :
-One server housing /home for the whole department and making it available through NFS.
-Authentication is made through kerberos and nis on another machine
-users can login from any machine on the network and authenticate as said before through the centralized nis and kerberos.
-/home is then mounted locally (on the user's machine) and the user can acces his/her home directory as if it was on the machine he/she's working on.

Now the problem is : often users have root acces on their machines but not on the authentication server. Yet for normal operation they authenticate aginst the remote server. But if they are root on the local machine they can then su to another user, and by that mean gain acces to their home directories while they shouldn't, Provided they create a local user with the same username and uid as on the remote server.

Now I don't know if I made myself clear enough. Please let me know so I can update my question on techrepublic, maybe I'll get some answers.

Thank you.

by jreed

Depending on the size of the dept., you may want to export the individual home directories to the respective machines, so that the user will only have their own home directory mounted.

by jreed

After reviewing the nfs-howto on my box, I found the relevent section:

6.2. Server security: nfsd and mountd

On the server we can decide that we don't want to trust the client's root
account. We can do that by using the root_squash option in /etc/exports:
/home slave1(rw,root_squash)

You may want to look at the howto at:
http://nfs.sourceforge.net/nfs-howto/

This discussion is closed to new replies.