Re: NFS exporting

[perry () snark imsi com (Perry E. Metzger)]

Scott D. Yelich says:
> I'd like to start a thread on the security issues surrounding using
> NFS and NFS exporting.
>
> First a little background: I'm starting up my own public access
> internet site and I am concerned about security issues relating to
> NFS.
>
> Here's an introductory question:
> How much does secure nfs (rpc) gain for you?

Secure rpc buys you only a little bit -- it requires a bit of skill to
break it, but it will doubtless be easy to break when someone posts a
cracking script to the net sometime.

As for NFS in general, its useless. As soon as you export an NFS
partition to the net (at least if you export it writable), you can
kiss your machine goodbye. Among other nasty tricks, even without the
mountd giving you any informaiton on the host you can just flood the
machine with unlink requests or guess inode generation numbers or
other such things. NFS is a hunk of junk.

Perry