topic Re: Allow root access to an NFS share from multiple clients in Operating System - HP-UX

Allow root access to an NFS share from multiple clients

Tony Walker_2 — Tue, 12 Apr 2005 05:05:19 GMT

Hi Guys,

OK, so I know that I can use -root=server1:server2 etc to allow root from a specific NFS client to have root privileges... However, I want to set this for ANY client that may attach to this share. Is there some sort of -root=* equivalent I can use?

Cheers,

Tony

Re: Allow root access to an NFS share from multiple clients

harry d brown jr — Tue, 12 Apr 2005 06:22:04 GMT

Just

chmod -R 777 directoryofnfsmount

effectively the same thing.

live free or die
harry d brown jr

Re: Allow root access to an NFS share from multiple clients

Tony Walker_2 — Tue, 12 Apr 2005 07:15:46 GMT

I should explain. The FS being exported will contain users filesystems so I can't have that sort of permission set. I would just like to allow root to have root access only.

Re: Allow root access to an NFS share from multiple clients

harry d brown jr — Tue, 12 Apr 2005 07:34:17 GMT

If you don't specifically specify hosts with -root=, then a user can masquerade as root and mount the NFS and have full privileges, so why not just make everything 777 ?

live free or die
harry d brown jr

Re: Allow root access to an NFS share from multiple clients

Tony Walker_2 — Tue, 12 Apr 2005 08:05:32 GMT

This is true but I'm more prepared to take that risk than I am to just leave it wide open by default. I'm more interested in whether there is a way of implementing -root=*. If there is not then its back to the drawing board..

Thanks.

Re: Allow root access to an NFS share from multiple clients

harry d brown jr — Tue, 12 Apr 2005 08:07:06 GMT

I haven't found anything that would allow that, though it would be "nice".

live free or die
harry d brown jr

Re: Allow root access to an NFS share from multiple clients

Florian Heigl (new acc) — Tue, 12 Apr 2005 08:17:17 GMT

I'm also not a friend of using world-writeable permission, assuming that the remote hosts nfsd is running on a priveledged port, the chance of someone escalating his privileges is at least lower than is just anyone may access anything in any way.

but, to answer Your question: most unices would offer -maproot=root - but we don't have it. I'd recommend You to switch over to using a netgroup for this share:

/share -access=@clients -root=@clients with 'clients' being defined in /etc/netgroups. while this won't automatically set the root access, the result will be the same.

The worse way would be setting -anon=0 which would give root permissions to just anyone.