NFS 3 and the specter of the spoof attack
What should the CIO do differently next time? The best solution is to upgrade to NFS 4, which comes with much more sophisticated security features, such as Kerberos authentication and GSS-API support. Configuring these additional components definitely takes some effort, but the result is a much more secure environment.
If, for whatever reason, you have a need to continue with NFS 3, keep the following tips in mind:
- Make sure you don't export rw-volumes to everyone.
- Keep reasonable control over your IP addresses. For instance, use a physically separate address space and make sure no one has logical access to it, impose some form of Layer 2 authentication (such as IEEE 802.1x) for all clients on the segment,or use VLANs with IEEE 801.1q tagging for communication between NFS servers and clients.
- If feasible, use dedicated VPN tunnels to protect and authenticate NFS traffic.
Of course, if you add all these additional security structures to your NFS 3 configuration, your system could end up much more complex than if you had simply upgraded to NFS 4, but at least you'll sleep better knowing you have patched some of the cracks in NFS.
Buy this article as PDF
Four-inch-long computer on a stick lets you boot a full Linux system from any HDMI display device.
New statute would require companies to report break-ins to consumers.
Weird data transfer technique avoids all standard security measures.
FIDO alliance declares the beginning of the end for old-style login authentication.
The Linux New Media Awards have honored the most significant products, projects, people, and organizations for open source/Linux every year since 2000.
Legendary Uber-distro splits over the systemd controversy.
New LTS version offers many refinements for the Cinnamon and Mate desktops and significant improvement under the hood.
One of CeBIT’s most successful forums returns in 2015.
A new study says it is possible to unmask 81% of TOR users.
Redmond joins the revolution by turning the .NET Core Runtime into a GitHub project.