Mounting NFS directory owned by root

NFS is a widely-used file sharing protocol. It allows servers running nfsd and mountd to "export" entire file systems to other machines using NFS filesystem support built in to their kernels (or some other client support if they are not Linux machines). mountd keeps track of mounted file systems in /etc/mtab, and can display them with showmount.

Many sites use NFS to serve home directories to users, so that no matter what machine in the cluster they login to, they will have all their home files.  There is some small amount of security allowed in exporting file systems. You can make your nfsd map the remote root user (uid=0) to the nobody user, denying them total access to the files exported. However, since individual users have access to their own (or at least the same uid) files, the remote root user can login or su to their account and have total access to their files. This is only a small hindrance to an attacker that has access to mount your remote file systems.

Export the root dir to the workstation. The basic idea is to edit /etc/exports  to include a line similar to one of the following:

• /path/on/server/to/nfs_root <client-IP-number>(rw,no_root_squash,no_all_squash) <2nd-client-IP-number>(rw,no_root_squash,no_all_squash)
• /path/on/server/to/nfs_root <client-IP-network>/<client-IP-netmask>(rw,no_root_squash,no_all_squash)

For example, a DHCP client receiving an IP address on a class C subnet would need an exports entry similar to this:

• /path/on/server/to/nfs_root 192.168.263.0/255.255.255.0(rw,no_root_squash,no_all_squash)

The no_root_squash  parameter allows the superuser (root) to be treated as such by the NFS server; otherwise root will be remapped to nobody and will generally be unable to do anything useful with the filesystem. The no_all_squash  parameter is similar but applies to non-root users. See the exports(5)  man page for details.

You will have to notify the NFS server after making any changes to the exports file. Under Red Hat this can easily be done by typing /etc/rc.d/init.d/nfs stop; /etc/rc.d/init.d/nfs start. On other systems, a simple /etc/rc.d/init.d/nfs restart  or even exportfs -a  may suffice, while on older machines running the user-mode NFS daemon you may actually need to killall -HUP rpc.mountd; killall -HUP rpc.nfsd. (Do not killall -HUP rpc.portmap, however!)

You may also need to edit /etc/hosts.allow  and/or /etc/hosts.deny  if tcp_wrappers are installed. In particular, if the remote system (client) gets RPC: connection refused errors, /etc/hosts.deny  probably contains portmap: ALL  or ALL: ALL. To enable the client to use the server's portmapper, add a corresponding line to /etc/hosts.allow:

portmap: <client-IP-number>
portmap: <2nd-client-IP-number>
portmap: <client-IP-network>/<client-IP-netmask>

There is no need to restart anything in this case. You can check by running rpcinfo -p  on the NFS server and rpcinfo -p NFS-server  on a Linux client within the allowed range; the RPC services listed by both should match.

Exporting NFS File Systems

The General Options tab allows the following options to be configured:

• Allow connections from port 1024 and higher — Services started on port numbers less than 1024 must be started as root. Select this option to allow the NFS service to be started by a user other than root. This option corresponds to insecure.
• Allow insecure file locking — Do not require a lock request. This option corresponds to insecure_locks.
• Disable subtree checking — If a subdirectory of a file system is exported, but the entire file system is not exported, the server checks to see if the requested file is in the subdirectory exported. This check is called subtree checking. Select this option to disable subtree checking. If the entire file system is exported, selecting to disable subtree checking can increase the transfer rate. This option corresponds to no_subtree_check.
• Sync write operations on request — Enabled by default, this option does not allow the server to reply to requests before the changes made by the request are written to the disk. This option corresponds to sync. If this is not selected, the async option is used.
  • Force sync of write operations immediately — Do not delay writing to disk. This option corresponds to no_wdelay.

The User Access tab allows the following options to be configured:

• Treat remote root user as local root — By default, the user and group IDs of the root user are both 0. Root squashing maps the user ID 0 and the group ID 0 to the user and group IDs of anonymous so that root on the client does not have root privileges on the NFS server. If this option is selected, root is not mapped to anonymous, and root on a client has root privileges to exported directories. Selecting this option can greatly decrease the security of the system. Do not select it unless it is absolutely necessary. This option corresponds to no_root_squash.
• Treat all client users as anonymous users — If this option is selected, all user and group IDs are mapped to the anonymous user. This option corresponds to all_squash.
  • Specify local user ID for anonymous users — If Treat all client users as anonymous users is selected, this option lets you specify a user ID for the anonymous user. This option corresponds to anonuid.
  • Specify local group ID for anonymous users — If Treat all client users as anonymous users is selected, this option lets you specify a group ID for the anonymous user. This option corresponds to anongid.

NEWS CONTENTS

Old News ;-)

Recommended Links

Softpanorama Recommended

Top articles

Sites