O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 20] 20.4 Improving NFS Security
[12] We have seen several "NFS shells" that allow a user to make such accesses in a largely automated way.
Secure NFS overcomes these problems by using AUTH_DES RPC authentication instead of AUTH_UNIX. With Secure NFS, users
must be able to decrypt a special key stored on the NIS or NIS+ server before the NFS filesystem will allow the user to access his or
her files.
To specify Secure NFS, you must specify the secure option both on the NFS server (in the exports file or the dfstab) and on the client
(in the /etc/fstab or /etc/vfstab file).
NOTE: Secure NFS requires Secure RPC to function, and therefore may not be available on all versions of UNIX. If
you are in doubt about your system, check your documentation to see if your NFS mount command supports the secure
option. Also note that Secure RPC may not be available on non-UNIX implementations of NFS, either.
Here is an example of using Secure NFS. Suppose that a server has a filesystem /Users that it will export using Secure NFS. The
server's /etc/dfs/dfstab file might contain the following line:
share -F nfs -o secure,rw=clients /Users
Meanwhile, the clients /etc/vfstab file would have a matching line:
#device device mount FS fsck mount mount
#to moun to fsck pont type pass at boot options
#
server:/Users - /Users nfs - yes secure
20.3 Client-Side NFS Security 20.5 Some Last Comments
[ Library Home | DNS & BIND | TCP/IP | sendmail | sendmail Reference | Firewalls | Practical Security ]
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch20_04.htm (6 of 6) [2002-04-12 10:45:41]