OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 4th quarter (Oct-Dec) 1994: Re: CERT, about NFS

Re: CERT, about NFS

Bela Lubkin (belalsco.COM)
Thu, 22 Dec 1994 05:56:50 -0800 

der Mouse wrote:

> I just got a CERT advisory about NFS that talks about some fairly
> obvious (once thought of) dangers of NFS.  It advises:
> 
> >      A. Filter packets at your firewall/router.  
> 
> >      B. Use a portmapper that disallows proxy access.
> 
> >      C. Check the configuration of the /etc/exports files on your hosts.
> >         In particular:
> 
> >          1. Do *not* self-reference an NFS server in its own exports file.
> >          2. Do not allow the exports file to contain a "localhost" entry.
> 
> Anyone know why these are recommended?  As far as I can see, if your
> portmapper doesn't do proxy calls and/or you firewall out port 111, and
> you don't care about local attacks, neither C.1 nor C.2 will buy you
> anything further.  Am I missing something, or are these bits of advice
> simply there for people who don't do A and B?

It depends how "soft and chewy" you want the inside of your firewall to
be.  You might try to keep the inside machines fairly tight so that *if*
someone breaches the firewall, they'll still have trouble moving around.
(This both tends to limit the damage done, and, by making them have to
*do things* to each system they attack, makes it more likely that you'll
notice their activities).

>Bela<