2:27 p.m.
Hi,
It was a while ago when I read that NFS was difficult to secure with (the
use of) ssh and iptables (or something like that).
I really needed an alternative that works and can be made secure. Is GFS a
suitable replacement for NFS? If not, what is the closest thing to NFS?
Thanks.
--
Daniel Yek
2:44 p.m.
On 2/7/07, Daniel Yek <dyek(a)real.com> wrote:
Hi,
It was a while ago when I read that NFS was difficult to secure with (the
use of) ssh and iptables (or something like that).
I really needed an alternative that works and can be made secure. Is GFS a
suitable replacement for NFS? If not, what is the closest thing to NFS?
Thanks.
Subdue NFS to use only one port, firewall all other ports
off....possible filter the NFS port too?
--
Fedora Core 6 and proud
3:08 p.m.
On Wed, Feb 07, 2007 at 12:27:37PM -0800, Daniel Yek wrote:
I really needed an alternative that works and can be made secure. Is
GFS a
suitable replacement for NFS? If not, what is the closest thing to NFS?
The only thing GFS shares with NFS is the letters "F" and "S". It is
otherwise an entirely different thing.
The closest thing to what you want is NFSv4 with Kerberos.
--
Matthew Miller mattdm(a)mattdm.org <http://mattdm.org/>
Boston University Linux ------> <http://linux.bu.edu/>
3:53 p.m.
Am Mittwoch, den 07.02.2007, 16:08 -0500 schrieb Matthew Miller:
On Wed, Feb 07, 2007 at 12:27:37PM -0800, Daniel Yek wrote:
> I really needed an alternative that works and can be made secure. Is GFS a
> suitable replacement for NFS? If not, what is the closest thing to NFS?
The only thing GFS shares with NFS is the letters "F" and "S". It is
otherwise an entirely different thing.
The closest thing to what you want is NFSv4 with Kerberos.
--
Matthew Miller mattdm(a)mattdm.org <http://mattdm.org/>
Boston University Linux ------> <http://linux.bu.edu/>
and perhaps -o tcp with udp firewalled?
4:09 p.m.
On Wed, Feb 07, 2007 at 10:53:52PM +0100, nodata wrote:
> The only thing GFS shares with NFS is the letters "F"
and "S". It is
> otherwise an entirely different thing.
> The closest thing to what you want is NFSv4 with Kerberos.
and perhaps -o tcp with udp firewalled?
NFSv4 is TCP-only. (Although apparently the Linux implementation might
support UDP as a non-standard option.)
--
Matthew Miller mattdm(a)mattdm.org <http://mattdm.org/>
Boston University Linux ------> <http://linux.bu.edu/>
4:34 p.m.
On Thu, 2007-02-08 at 17:09 -0500, Matthew Miller wrote:
NFSv4 is TCP-only. (Although apparently the Linux implementation
might
support UDP as a non-standard option.)
NFSv4 can go through firewalls quite nicely, in fact
system-config-securitylevel has a checkbox for it. I've never ever had
any luck getting NFSv3 to pipe through NAT or a SSH tunnel etc.
I recently started switching all my systems over to NFSv4, so I can
enable their firewalls. (With IPv6, you can no longer count on the
safety of NAT...) I'm having strange problems with one of my boxes, the
system locks up hard any time I actually try and use the mount for very
long. Its my "HTPC" and playing video off it on another machine will do
it every time.
And then there's the PPC box that refuses to mount NFSv4 at all...
3:52 p.m.
On Wed, Feb 07, 2007 at 12:27:37PM -0800, Daniel Yek wrote:
Hi,
It was a while ago when I read that NFS was difficult to secure with (the
use of) ssh and iptables (or something like that).
I really needed an alternative that works and can be made secure. Is GFS a
suitable replacement for NFS? If not, what is the closest thing to NFS?
What is your threat model? What do you want to be secured against?
OG.
4:04 p.m.
On Wednesday 07 February 2007 01:27pm, Daniel Yek wrote:
Hi,
It was a while ago when I read that NFS was difficult to secure with (the
use of) ssh and iptables (or something like that).
I really needed an alternative that works and can be made secure. Is GFS a
suitable replacement for NFS? If not, what is the closest thing to NFS?
Kerberized NFS, preferably NFS4.
AndrewFS or CodaFS.
--
Lamont Peterson <lamont(a)gurulabs.com>
Senior Instructor
Guru Labs, L.C. [ http://www.GuruLabs.com/ ]
NOTE: All messages from this email address should be digitally signed with my
0xDC0DD409 GPG key. It is available on the pgp.mit.edu keyserver as
well as other keyservers that sync with MIT's.
5:53 p.m.
On 2/7/07, Lamont Peterson <lamont(a)gurulabs.com> wrote:
On Wednesday 07 February 2007 01:27pm, Daniel Yek wrote:
> Hi,
>
> It was a while ago when I read that NFS was difficult to secure with (the
> use of) ssh and iptables (or something like that).
>
> I really needed an alternative that works and can be made secure. Is GFS a
> suitable replacement for NFS? If not, what is the closest thing to NFS?
Kerberized NFS, preferably NFS4.
AndrewFS or CodaFS.
--
Lamont Peterson <lamont(a)gurulabs.com>
Senior Instructor
Guru Labs, L.C. [ http://www.GuruLabs.com/ ]
It sounds like there are those of you who actually get NFS4 to work. I
have tried twice on FC6, and have yet to succeed myself, just gave up
and used NFS3. I opened a thread on the general mailing list about it
but got no real help.
--
Fedora Core 6 and proud
6:15 p.m.
On Wed, Feb 07, 2007 at 05:53:40PM -0600, Arthur Pemberton wrote:
On 2/7/07, Lamont Peterson <lamont(a)gurulabs.com> wrote:
>On Wednesday 07 February 2007 01:27pm, Daniel Yek wrote:
>> Hi,
>>
>> It was a while ago when I read that NFS was difficult to secure with (the
>> use of) ssh and iptables (or something like that).
>>
>> I really needed an alternative that works and can be made secure. Is GFS
>a
>> suitable replacement for NFS? If not, what is the closest thing to NFS?
>
>Kerberized NFS, preferably NFS4.
>
It sounds like there are those of you who actually get NFS4 to work. I
have tried twice on FC6, and have yet to succeed myself, just gave up
and used NFS3. I opened a thread on the general mailing list about it
but got no real help.
I am running NFS4 with kerberos since FC5 (maybe even earlier) with only minor
problems here and there. There is a problem with krb5 since 2.6.18 that
prevents multiple mounts (bugzilla #218330) in FC5/6 so you might have some
problems.
4:09 p.m.
On Wed, Feb 07, 2007 at 03:04:46PM -0700, Lamont Peterson wrote:
AndrewFS or CodaFS.
^^^^^^^
No.
--
Matthew Miller mattdm(a)mattdm.org <http://mattdm.org/>
Boston University Linux ------> <http://linux.bu.edu/>
7:19 p.m.
On Thursday 08 February 2007 03:09pm, Matthew Miller wrote:
On Wed, Feb 07, 2007 at 03:04:46PM -0700, Lamont Peterson wrote:
> AndrewFS or CodaFS.
^^^^^^^
No.
:) Agreed.
He asked *is* there an alternative, so I listed an alternative.
--
Lamont Peterson <lamont(a)gurulabs.com>
Senior Instructor
Guru Labs, L.C. [ http://www.GuruLabs.com/ ]
NOTE: All messages from this email address should be digitally signed with my
0xDC0DD409 GPG key. It is available on the pgp.mit.edu keyserver as
well as other keyservers that sync with MIT's.
9:05 p.m.
On 2/8/07, Lamont Peterson <lamont(a)gurulabs.com> wrote:
On Thursday 08 February 2007 03:09pm, Matthew Miller wrote:
> On Wed, Feb 07, 2007 at 03:04:46PM -0700, Lamont Peterson wrote:
> > AndrewFS or CodaFS.
>
> ^^^^^^^
>
> No.
:) Agreed.
He asked *is* there an alternative, so I listed an alternative.
--
Here is my iptables and nfs configuration. We flirted with nfsv4 however
the supported feature matrix is pretty sparse. For secure filesharing we
are migrating to OpenAFS.
[ajn@depweb ~]$ cat /etc/sysconfig/nfs
RPCNFSDCOUNT=35
STATD_PORT=10002
STATD_OUTGOING_PORT=10003
MOUNTD_PORT=10004
RQUOTAD_PORT=10005
[ajn@depweb ~]$ sudo cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
:NFS-INPUT - [0:0]
-A INPUT -j NFS-INPUT
-A FORWARD -j NFS-INPUT
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 53 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j
ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
# Firewall rules for NFS with the following restrictions set in the nfs
sysconfig:
# RPCNFSDCOUNT=25
# STATD_PORT=10002
# STATD_OUTGOING_PORT=10003
# MOUNTD_PORT=10004
# RQUOTAD_PORT=10005
#
-A NFS-INPUT -p tcp -m tcp --dport 111 -j ACCEPT
-A NFS-INPUT -p udp -m udp --dport 111 -j ACCEPT
-A NFS-INPUT -p tcp -m tcp --dport 2049 -j ACCEPT
-A NFS-INPUT -p udp -m udp --dport 2049 -j ACCEPT
-A NFS-INPUT -p tcp -m tcp --dport 10002:10005 -j ACCEPT
-A NFS-INPUT -p udp -m udp --dport 10002:10005 -j ACCEPT
#
COMMIT
11:03 p.m.
There is another alternative I use that doesn't require switching
filesystems. OpenVPN (http://openvpn.net/). I can hook in from
anywhere (It needs a single port open in your firewall and supports
either UDP or TCP. This way you can keep from opening up ports to the
outside and and allow access only through the VPN interface. NFS runs
quite well for me over it as packets are just routed and it took me
about 10 minutes to set up a server, generate keys and set up a client,
never having done this before.
-Tim
He asked *is* there an alternative, so I listed an alternative.
--
11:13 p.m.
Daniel Yek <dyek <at> real.com> writes:
It was a while ago when I read that NFS was difficult to secure with
(the
use of) ssh and iptables (or something like that).
I really needed an alternative that works and can be made secure. Is GFS a
suitable replacement for NFS? If not, what is the closest thing to NFS?
Is fuse-sshfs a viable alternative?
Others have also mentioned fully-userspace solutions, i.e. giving your apps
URLs instead of file names. Emacs has been given as an example, but it's not
the only editor to support this. Most KDE and GNOME apps support sftp:// URLs
(sftp ioslave in KDE, sftp gnome-vfs plugin in GNOME). Kate can work just fine
with sftp:// URLs, for example.
Kevin Kofler
12:55 a.m.
At 09:13 PM 2/7/2007, Kevin Kofler wrote:
> It was a while ago when I read that NFS was difficult to secure
with (the
> use of) ssh and iptables (or something like that).
>
> I really needed an alternative that works and can be made secure. Is GFS a
> suitable replacement for NFS? If not, what is the closest thing to NFS?
Is fuse-sshfs a viable alternative?
This is exciting. I briefly scan through several web sites, didn't find any
information about the perceived delay and fine-grained control of when it
syncs (ssh / scp out), etc. If the perceived delay on save is minimum -- as
fast as saving to the local disk, this would be a perfect solution that I
am looking for. I just need it to cache locally (which fuse-sshfs does) and
flush/sync when I want it to, or asynchronously in the background so that
it doesn't bother me with synchronous "delayed return". I can imagine it
being very useful, but I'll have to give myself time to use it for a while.
Thanks a bunch.
http://marc.abramowitz.info/archives/2006/02/21/fusesshfs/
Install:
yum install fuse-sshfs
Or:
apt-get install sshfs
adduser yourlocalusername fuse
(log out and back in so that it recognizes me as a member of the
group "fuse")
How to mount a filesystem:
sshfs hostname: mountpoint
To unmount the filesystem:
fusermount -u mountpoint
--
Daniel Yek
Others have also mentioned fully-userspace solutions, i.e. giving your
apps
URLs instead of file names. Emacs has been given as an example, but it's not
the only editor to support this. Most KDE and GNOME apps support sftp:// URLs
(sftp ioslave in KDE, sftp gnome-vfs plugin in GNOME). Kate can work just
fine
with sftp:// URLs, for example.
Kevin Kofler
6297
days inactive
6299
days old
15 comments
11 participants
participants (11)
-
Alastair Neil -
Arthur Pemberton -
Callum Lerwick -
Daniel Yek -
Kevin Kofler -
Kostas Georgiou -
Lamont R. Peterson -
Matthew Miller -
nodata -
Olivier Galibert -
Timothy Renner