NFS security (or lack of) am I missing something?

[Red Squirrel]

I want to start looking at turning up my new 24-bay file server and I plan to use NFS. In this process I also want to revamp how I manage file permissions and what not.

I finally got permissions kinda sorted out, basically from what I understand I need to mostly mirror the userid/group so that I can properly access files remotely without it screwing up permissions for new files I create.

Then it occurred to me... in a situation where the network is more public, what stops someone from turning up a Linux VM or plugging in a Linux system and just creating an account with same user id/group id? It seems the passwords are completely ignored with NFS. I know there is IP based security where I only allow certain hosts, but that's not really that high end when someone can just set their IP accordingly.

Am I missing something here? I know I can also use SMB, but that's for Windows, there has to be a Linux way of making this secure?

Also is there an easy way to manage ACLs? I want more granuarity with file security and the biggest thing I want is inheritance. Say user1:group1 owns a file structure, I want to be able to list a bunch of users that can access it, but I don't want the permissions to be changed based on who writes to it.

Right now my file system is just a mess because of all the work arounds I have to do due to the primitive nature of linux file permissions. I want to use ACLs to hopefully be able to be more granular but at same time from what I'm reading it looks very complicated to manage. Is there not a way to do it through a GUI like you would for NTFS?

 

[theevilsharpie]

NFS security seems complicated because you have to manually piece together things that Windows does behind the scenes, but it works essentially the same way: you authenticate with the NFS server, and it grants you access.

Early versions of NFS didn't have much in the way of native security other than basic IP and UID/GID mapping, but NFSv4 supports Kerberos authentication and NFSv4 ACLs. NFSv4 also supports encryption for data in transit (although you could always use IPSec).

 

[Cerb]

Am I missing something here? I know I can also use SMB, but that's for Windows, there has to be a Linux way of making this secure?

Yes: CIFS. Make sure it's not allowing old 56-bit encryption, or old auth methods, and move on. If it's, "for Windows," why is support for it baked right into the Linux kernel? It's open, it works well, and it's what most of us use for file shares, even if there's no Windows instances on the network.

Also is there an easy way to manage ACLs?

More shares, and/or more user groups, and/or a Windows server and Windows clients . IoW, no. ACLs are always a pain, and have nearly zero GUI support, because we can always find some way to not use them, after trying again to see if they're any better than they used to be.

 

[Red Squirrel]

Well my question is more to the fact that, when I setup a client, I don't even need to put in any kind of password or anything. I just need to make sure that the user ID / group ID of my user accounts match. So how is this secure exactly? Or does it work because my user account passwords are the same?

I know there's kerberos/ldap and all that, but I'm talking about environments that don't use that.

 

[theevilsharpie]

Well my question is more to the fact that, when I setup a client, I don't even need to put in any kind of password or anything. I just need to make sure that the user ID / group ID of my user accounts match. So how is this secure exactly? Or does it work because my user account passwords are the same?

I know there's kerberos/ldap and all that, but I'm talking about environments that don't use that.

NFS relies on external security.

If we assume that Kerberos authentication is off the table, you can use IPSec in conjunction with public-key encryption to mutually authenticate connections. If IPSec isn't an option, you can use IP-based authentication in conjunction with WPA or 802.1x with RADIUS. If that isn't an option, you can require clients to tunnel NFS traffic over SSH, which requires authentication first.

If you're simply asking in an indirect way whether NFS has built-in support for password authentication, the answer is no.

 

[Fallen Kell]

NFS doesn't so much rely on external security as much as it relies on proper share permissions being created. In other words, don't do a global read/write share, otherwise, globally, anyone can read/write to it.

Depending on the OS, the files and settings are a little different, but for Linux, in general it is the "/etc/exports" file that controls the share permissions. You basically want to lock down which hosts you are allowing read/write access. This won't stop someone from being able to setup a VM which uses NAT to use the same IP address as the host system from being able to gain access. You rely on the OS security of the systems you are trusting to not allow someone to create/run the VM. It also will not protect against someone spoofing an IP address. To protect against that, you need something more complex like what theevilsharpie is advocating.

 

[Cerb]

Or, in simpler terms: NFS is made for the network itself to already be secured, and for the rest of the settings to just be permissions amongst users trusted by the network. NFS isn't a bad thing, but it's more of a special-purpose file sharing tool, rather than general-purpose one.