upvote

points

by mmh00003 hours ago |
comments
upvoteby chungy3 hours ago|
next
[-]
Funny part is, that NFSv4 supports SIDs for user authentication, but the Linux implementation leaves it out (among all the other ACL features) simply on the basis that Linux doesn't support them at all.

The FreeBSD, Solaris, Mac OS X, and Windows (yes, even Windows) implementations of NFSv4 are fully featured with this stuff.

reply
upvoteby feurio1 hours ago|
prev|
next
[-]
> Setting up Kerberos just to authenticate users for access to my Linux ISOs is a crazy large requirement!

Export as read only?

reply
upvoteby projektfu3 hours ago|
prev|
next
[-]
Will this matter if it's running on localhost and only accessible to the users there? She's just using it as a stand-in for FUSE.
reply
upvoteby mmh00003 hours ago|
parent|
[-]
To be clear: I am not criticizing the use case in the article. It's a silly, fun, and creative hacking together of technology.

I am criticizing NFS as a whole, and specifically its Linux implementation.

reply
upvoteby nine_k3 hours ago|
prev|
next
[-]
Does this mean that I can connect to an NFS server saying my UID=0 and get local root?
reply
upvoteby mmh00003 hours ago|
parent|
[-]
Usually, no. NFS defaults to "root_squash," which silently changes UID=0 to the UID of the `nfsnobody` user.

However, in the /etc/exports file, you can (but shouldn't) add the share option "no_root_squash" which disables that.

So, root access is slightly protected. But all other users are wide open.

reply
upvoteby IshKebab1 hours ago|
prev|
next
[-]
Even worse is the .nfs "silly renaming" nonsense. I was under the impression that NFSv4 fixed that but someone told me it doesn't.
reply
upvoteby steveBK1233 hours ago|
prev|
next
[-]
So many battle scars from NFS in production for me as well.

Wish the downvoters all the best in their future NFS endeavors.

reply
upvoteby skydhash3 hours ago|
prev|
[-]
> The fact that NFSv4 has no concept of true "Authentication" and just blindly accepts whatever the client sends is the craziest network application design ever

Doesn’t the secure option require ports only a root user can bind too? And you can always create secure tunnels if the physical network is insecure.

reply
upvoteby mmh00003 hours ago|
parent|
[-]
Sure, if you (the admin) have full control over the NFS server, the network, and the client devices, NFS can be secure with the help of Kerberos. But this isn't a simple thing. A Kerberos server needs to be set up, Kerberos clients need to be configured on the NFS server and client, tickets need to be issued, firewall ports need to be opened, and user accounts need to be centrally managed. That's all fine for an Enterprise.

Now, how about this common scenario: I want to run a file-sharing server on my network. I want a random "friend" to come over and grab a copy of a file, but I don't want them to see any other files on the NFS server.

So, the "friend" has root access on their device. They can just log in and lie to the NFS server, claim they're my UID, and see all my files that I didn't want them to access. Configuring KRB in that scenario is totally impractical.

reply
upvoteby skydhash2 hours ago|
parent|
[-]
> Now, how about this common scenario: I want to run a file-sharing server on my network. I want a random "friend" to come over and grab a copy of a file, but I don't want them to see any other files on the NFS server.

How is that a common scenario? Why not give them your drive and the encryption key while you’re at it? It would be way faster.

The correct scenario would be to just copy the file and serve it with ftp or http on another interface.

reply
upvoteby mmh00001 hours ago|
parent|
[-]
Ah, so you agree NFS is not fit for purpose (network file sharing), and I should use something else to share files over the network.

EDIT (the above is a bit more snark than I intended, let me add a little more):

NFS's direct (still widely used) competitor, SMB, natively supports:

  - Authentication
  - Transfer encryption
  - Authentication encryption
  - Has open implementations across platforms
  - Supports individual account management, and large enterprisey account management (LDAP/AD/etc)
With SMB, I can share out a directory on the network that allows visitors access, optionally authenticated with a simple username and password.

I can share out specific directories with easy control over who can access what. You know, basic network file sharing capabilities.

[[ And, don't take this as a love for SMB, it too has many issues and legacy junk ]]

reply
upvoteby skydhash44 minutes ago|
parent|
[-]
> Ah, so you agree NFS is not fit for purpose (network file sharing), and I should use something else to share files over the network

NFS stands for Network File System, not Network File Sharing. If you gave a disk to someone, the permission bits wouldn’t stand for anything too.

reply