2 - Raspberry PI Community Projects

perfectly correct, the clients do authenticate with the anonymous username; the password is
often, by convention, the user's email address, but the server ignores it.
Many FTP servers are available in Debian (ftpd, proftpd, wu-ftpd and so on). The Falcot Corp
administrators picked vsftpd because they only use the FTP server to distribute a few files (including
a Debian package repository); since they don't need advanced features, they chose to
focus on the security aspects.
Installing the package creates an p system user. This account is always used for anonymous
FTP connections, and its home directory (/home/ftp/) is the root of the tree made available
to users connecting to this service. The default configuration (in /etc/vsftpd.conf) is very
restrictive: it only allows read-only anonymous access (since the write_enable and anon_uplo
ad_enable options are disabled), and local users cannot connect with their usual username and
password and access their own files (local_enable option). However, this default configuration
is well-suited to the needs at Falcot Corp.
11.4. NFS File Server
NFS (Network File System) is a protocol allowing remote access to a filesystem through the network.
All Unix systems can work with this protocol; when Windows systems are involved,
Samba must be used instead.
NFS is a very useful tool, but its shortcomings must be kept in mind especially where security
matters are concerned: all data goes over the network in the clear (a sniffer can intercept it); the
server enforces access restrictions based on the client's IP address (which can be spoofed); and
finally, when a client machine is granted access to a misconfigured NFS share, the client's root
user can access all the files on the share (even those belonging to other users) since the server
trusts the username it receives from the client (this is a historical limitation of the protocol).
DOCUMENTATION
NFS HOWTO
The NFS HOWTO is full of interesting information, including methods for
optimizing performance. It also describes a way to secure NFS transfers with
an SSH tunnel; however, that technique precludes the use of lockd).
➨ http://nfs.sourceforge.net/nfs-howto/
11.4.1. Securing NFS
Since NFS trusts the information it receives from the network, it is vital to ensure that only the
machines allowed to use it can connect to the various required RPC servers. The firewall must
also block IP spoofing so as to prevent an outside machine from acting as an inside one, and access
to the appropriate ports must be restricted to the machines meant to access the NFS shares.
BACK TO BASICS
RPC
RPC (Remote Procedure Call) is a Unix standard for remote services. NFS is
one such service.
276 The Debian Administrator's Handbook