Security mechanism of the NFS.

[Eberno]

MY friends,

they are anybody that knows some mechanisms of security for the NFS.
What kind of mechanism I can use?

[Christian Tremblay]

Yes, it's called Samba ;-)

[Steven E. Protter]

Shalom Erberno,

There really is no security mechanism in NFS.

NFS should only be used where the network is completely secure and trusted, such as behind a firewall.

NFS transmits its data in clear text making it readable by any on the network.

Samba can be teamed with encryption and used in place of NFS in many situations.

SEP

[Patrick Wallek]

You can control which machines can connect to mahcine via the /etc/exports file.

Other security is via your normal owner, group and world/other permissions on the files and directories.

[Steven E. Protter]

Shalom,

Patrick points out an important security mechanism which I did not remember.

The data still goes unencrpted across your network for all to see, whether authorized to mount or not.

SEP

[Jeff_Traigle]

In addition to the access= specification in /etc/exports, one thing to consider NOT doing is including root= specifications. This allows root on the specified hosts to access the NFS mounted file system (on a read-write mount, root can write also) and is generally considered a Bad Thing(TM).

[Steve Lewis]

What about NFS over SSL?
e.g.
http://www.crufty.net/Products/sNFS.html

Also, don't forget VPN /IPSec etc.

Do a google search on NFS over SSL

[Robert Fritz]

True, NFSv3 doesn't have cryptographic authentication nor integity proteection, and though some have gotten SSH-tunneling (which uses SSL), its not supported, and pretty klunky.

The good news is that NFS protocol-4 does have cryptographic integrety and authentication. I'd expect to see that support coming soon.

[Eberno]

Robert,

When I found this NFS Protocol-4???