NFS

[Marcelo De Florio_1]

Anybody know, the problems of security for this protocol

[Patrick Wallek]

What kind of problems are you referring to? Do you have any specific security concerns about NFS?

If you set up your /etc/exports file correctly then you can restrict which machines mount which exported directories. You can do a 'man exports' for more information on that file.

[Shannon Petry]

As previously stated, the biggest problems are with full world access, and rpc.statd.

in /etc/exports, you should specify something like
/mydisk -rw=host1:host2,ro=host3:host4

This would give read-write access to host1 and host2, read-only access to host3 and host3. All others would be denied access.
I myself for large sites use netgroups to make exporting a whole lot shorter. Remember that root access can only be granted to host.

rpc.statd has many conceptual flaws, which must exist for it to work properly.

SunOS supports a nice "domain" feature for exports which will try to apply host.defined-domain to unresolvable connections. If it can not resolve host1, it will try host1.domain.com. If it can not resolve this, then the connection is refused. This is nice because there can be problems with your own security.....


Hope it helps,
Shannon