topic Re: root_squash in Operating System - Linux

root_squash

'chris' — Thu, 07 May 2009 11:30:20 GMT

hi

can someone explain pls root_squash parameter from Network File System (NFS)?

Re: root_squash

Jozef_Novak — Thu, 07 May 2009 11:48:17 GMT

Hi Chris,

IMHO this parameter determines whether root user is allowed to access a NFS-shared filesystem.

J.

Re: root_squash

avizen9 — Thu, 07 May 2009 12:34:11 GMT

Hello,

root_squash - Requests from root clients are mapped to the nobody user and group ID so they will only have file privileges associated with other

Please also check below for more details info

http://www.linuxsecurity.com/content/view/117705/171/

Re: root_squash

'chris' — Thu, 07 May 2009 13:20:00 GMT

my /etc/exports from nfs server is:

/nfs/box 192.168.0.0/24(rw,no_wdelay,root_squash,insecure_locks,anonuid=1025,anongid=100)

I mount from the nfs client without problems.
But if I have in /etc/exports root_squash on the server than I cannot write via nfs client on the nfs server.
If I change to no_root_squash then I can write.
What's the problem?

Re: root_squash

Matti_Kurkela — Thu, 07 May 2009 17:12:48 GMT

If root_squash is enabled and the root user of the NFS client host is accessing the NFS-mounted filesystem, the NFS server will re-map the root's identity to "nobody" (traditional), "nfsnobody" (on some Linux distributions and/or types of Unix) or the user identified with the anonuid and anongid options. In other words, the client-side root privilege is "squashed" away. Only the root of the NFS server has true root-level access on the shared disk.

This is a security feature. If the NFS server shares a filesystem that contains executables (e.g. /usr) and an unauthorized person gets root access on the NFS client host, without the root_squash feature the user could replace any binary in the server's filesystem with a SUID root binary of his/her own design.
If s/he can then make any user (or even a cron job) on the server to run his/her tampered executable, that executable can easily give him/her unauthorized root access on the server too.

MK

Re: root_squash

Court Campbell — Thu, 07 May 2009 17:54:10 GMT

Since this has already been answered, I can tell you what it's not. It definitely is not a vegetable eaten during NFS file transfers.

Re: root_squash

Steven E. Protter — Thu, 07 May 2009 23:39:15 GMT

Shalom,

My understanding is root_squash controls whether root can mount an NFS share as root or not.

By default as a security measure you can not mount an NFS share remotely as root. The reason is the local sharing system can not guarantee or know the security level of the client.

An insecure host could mount a share and the sharing system can be exploited.

SEP

Re: root_squash

Court Campbell — Mon, 11 May 2009 14:31:48 GMT

SEP, Matti is actually correct.