root_squash

['chris']

hi

can someone explain pls root_squash parameter from Network File System (NFS)?

[Jozef_Novak · Accepted solution]

Hi Chris,

IMHO this parameter determines whether root user is allowed to access a NFS-shared filesystem.

J.

[avizen9]

Hello,

root_squash - Requests from root clients are mapped to the nobody user and group ID so they will only have file privileges associated with other

Please also check below for more details info

http://www.linuxsecurity.com/content/view/117705/171/

['chris']

my /etc/exports from nfs server is:

/nfs/box 192.168.0.0/24(rw,no_wdelay,root_squash,insecure_locks,anonuid=1025,anongid=100)

I mount from the nfs client without problems.
But if I have in /etc/exports root_squash on the server than I cannot write via nfs client on the nfs server.
If I change to no_root_squash then I can write.
What's the problem?

[Matti_Kurkela]

If root_squash is enabled and the root user of the NFS client host is accessing the NFS-mounted filesystem, the NFS server will re-map the root's identity to "nobody" (traditional), "nfsnobody" (on some Linux distributions and/or types of Unix) or the user identified with the anonuid and anongid options. In other words, the client-side root privilege is "squashed" away. Only the root of the NFS server has true root-level access on the shared disk.

This is a security feature. If the NFS server shares a filesystem that contains executables (e.g. /usr) and an unauthorized person gets root access on the NFS client host, without the root_squash feature the user could replace any binary in the server's filesystem with a SUID root binary of his/her own design.
If s/he can then make any user (or even a cron job) on the server to run his/her tampered executable, that executable can easily give him/her unauthorized root access on the server too.

MK

[Court Campbell]

Since this has already been answered, I can tell you what it's not. It definitely is not a vegetable eaten during NFS file transfers.

[Steven E. Protter]

Shalom,

My understanding is root_squash controls whether root can mount an NFS share as root or not.

By default as a security measure you can not mount an NFS share remotely as root. The reason is the local sharing system can not guarantee or know the security level of the client.

An insecure host could mount a share and the sharing system can be exploited.

SEP

[Court Campbell]

SEP, Matti is actually correct.