Contents
Is NFS safe over Internet?
NFS itself is not generally considered secure – using the kerberos option as @matt suggests is one option, but your best bet if you have to use NFS is to use a secure VPN and run NFS over that – this way you at least protect the insecure filesystem from the Internet – ofcourse if someone breaches your VPN you’re …
Can NFS be hacked?
The Network File System (NFS) in Linux is used to mount remote file systems (similar to shares in Windows) from the local machine. Hackers love these remote systems! Given the remote access nature of NFS, it certainly has its fair share of hacks.
What is NFS vulnerability?
NFS like any other unprotected network protocol is vulnerable to two types of attacks: eavesdropping and impostor attack. An eavesdropper can pick up unauthorized data as it goes by on the network. An impostor can gain an unauthorized access to the network.
Is it safe to use NFS on a WAN?
The most important concern seems to be security. Standard NFS uses UDP communication, which is more prone to sniffing and attacks than TCP appears to be (which NFS can use alternatively). So the general idea of using NFS over a WAN network isn’t doomed at all, but you’ll need to take measures to secure your communication.
Is it safe to use NFS v3 with SYS = system?
But if you use NFS v3 or NFS v4 with sys=system, then no, it’s not secure at all. There might also be some concern with exposing the kerberos and rpc ports to the internet at large, just in case of unknown vulnerabilities.
What do you need to know about NFS utils?
Versions 0.2.0 and higher of the nfs-utils package also use the hosts.allowand hosts.denyfiles, so you should put in entries for lockd, statd, mountd, and rquotadin these files too. For a complete example, see Section 4, “Setting up an NFS Client”. The above things should make your server tighter.
How does a client gain access to a remote file in NFS?
With NFS, there are two steps required for a client to gain access to a file contained in a remote directory on the server. The first step is mount access. Mount access is achieved by the client machine attempting to attach to the server. The security for this is provided by the /etc/exportsfile.