8

How can I make NFS connection secure? Remote server is on the internet, and not in local network. The server has no firewall and connected to internet directly.

Eonil
  • 10,459
  • 16
  • 36
  • 54

5 Answers5

9

The server has no firewall

If the remote system is not secure (and an absence of any firewalling makes that decidedly suspect) then its doesn't matter what you do to your connection - you can't be confident of security. This is particularly true for an NFS server where authentication is not tied into the underlying protocol.

If you're assertions are correct (which I find astonishing) then find out who configured the server this way and block them out before they can do any more harm.

If you need access to NFS across the internet, use a VPN (IPSEC, SSL tunnel, SSH tunnel, even pptp) and BLOCK all direct internet access (other than the secure connection) on the server.

kaiser
  • 1,251
  • 1
  • 16
  • 24
symcbean
  • 21,009
  • 1
  • 31
  • 52
  • Oh I configured my machine myself. I'm newbie on service server, and starting practical service. Please forgive me :) I agree that no firewall is incredibly **BAD** configuration. I couldn't thought about protocol without authentication like NFS will serve anyone who can connect the machine. Thanks. – Eonil Mar 09 '11 at 02:01
  • Sorry, but I disagree about the rant. A linux server without firewall is not automatically insecure. And with a firewall, it is not automatically secure. If one adds a firewall and then opens the NFS ports to the public, data theft is very likely to happen very soon. Furthermore, a VPN doesn't solve the problem of the weak authentication support in NFS, so you should probably suggest to install Kerberos instead of just running a VPN. – Kai Petzke Jan 23 '23 at 08:41
  • Read my comment again - I said that the absence of a firewall IMPLIES security issues. If you have a solution for the OP perhaps you could post the details here. And providing an alternate network path is of no value without closing the public access. – symcbean Jan 23 '23 at 16:54
7

You could tunnel it through SSH.

  • Here is a guide for NFS4.
  • Here is a guide for NFS3.
Andrew Savinykh
  • 526
  • 2
  • 7
  • 21
Kenny Rasschaert
  • 9,045
  • 3
  • 42
  • 58
1

If NFS is used on the system, please proceed via the following measures:

  1. If possible only allow read-only access to your exported data (-ro)
  2. Do not export the root folder / or /etc
  3. Deactivate NFS, if you do not wish to export any file systems.
  4. Access to NFS exports must be restricted to specified hosts
  5. If zfs filesystems are present, check also their attributes do not configure them to be shared over NFS.
  6. Use the -nosuid option for mounting folders, to prevent execution of setuid programs.
  7. Use the –nodev option for mounting folders, to prevent the sharing of device files.
Xao
  • 111
  • 1
0

There is a nice article on linuxjournal Encrypting NFSv4 with Stunnel TLS which explains how to use stunnel to protect NFSv4 traffic.

Inspired by this publication the NFS IETF working group on RPC-over-TLS protocol, that aims to add a native TLS support to NFS protocol (and any other protocol based on ONC/Sun RPC).

kofemann
  • 4,626
  • 1
  • 25
  • 30
0

It depends on what version of NFS you are using. Some of the above answers are prob. along the lines of some of what you want to do for versions prior to NFSv4.

  • NFSv3+ configure ssh connection via TCP wrappers which apparently is full of gotchas
  • Harden your network firewall NFSv*
    • Open ports for TCP, UDP, and rpcbind. default ports, and rcpbind configuration, may differ based on NFS version

According to Christopher Negus Linux Bible securing NFSv4, along with the above mentioned solutions, is best accomplished using Kerberos integration, which allows for configuration of user based access. This allows for more fine grained controls over which root use

Michael080
  • 1