OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 2nd quarter (Apr-Jun) 1994: Re: NFS exporting

Re: NFS exporting

smbresearch.att.com
Thu, 14 Apr 94 12:46:09 EDT 

	 >People can read and write your disk. In addition, anyone with access
	 >to your network can spoof NFS packets and either interfere with your
	 >view of whats on the disk or with the server's idea of what you are
	 >attempting to write (or read). The latter portion should be obvious -
	-
	 >its easy to mount an active attack on a udp based protocol

	  A while back I saw some discussion about NFS using tcp instead of
	  udp. Would this make things any more secure?

Yes, considerably; it's much harder (though by no means impossible)
to butt in to the middle of a TCP session.

(Advt.)  In our book, Bill Cheswick and I describe a proxy NFS setup,
using TCP, a user-level NFS server, and chroot.  4.4bsd and Sun's NFS
Version 3 support NFS over TCP; Linux has a user-level server.  It's
not hard to put the pieces together to do things that way, but it's
not standard yet.

		--Steve Bellovin