From: hamish@waikato.ac.nz
Newsgroups: comp.os.os2.networking
Subject: Re: NFS Security (or lack thereof)
Date: 12 Oct 92 17:15:04 +1300
Organization: University of Waikato, Hamilton, New Zealand

In article <1992Oct11.144549.16279@husc3.harvard.edu>, chandoni@husc8.harvard.edu (John-Marc Chandonia, , , ) writes:
> In article <1992Oct11.090253.21863@netcom.com>, badboy@netcom.com (Jay Keller) writes:
>> The problem:  my OS/2 users are in danger of getting kicked off the net 
>> because of how easily any of them can defeat the security of NFS and
>> potentially do mischief in the Unix world.  All an OS/2 user with IBM TCP/IP
>> has to do is set the UID and GID to anything he or she wants it to be, and 
>> then mount anywhere in the Unix file system with read and write privileges.
> 
> This is not true... the NFS server on the UNIX machine will ask
> for your password when you mount the disk.  If it doesn't, then
> you have real problems; anyone on the internet with a little
> programming knowledge could break into your system.
>

Where did you pick up your NFS knowledge? Face it. NFS is insecure. The very
design of it is for mounting disks (filesystems) between two (or more) SECURE
systems.

An NFS server WILL NOT ASK FOR A PASSWORD!! Some implementations of NFS for
insecure systems (ie the humble PC) will communicate with a password server
(pcnfsd) that will return a UID/GID for that username/password. 

Now when a transaction takes place, the requesting machine will specify the
UID/GID combination, and the NFS server will complete the transaction based on
the requesting IP address and the UID/GID combination. Now if the client wants
to change the UID/GID it can. As many times as it likes. (This is perfectly
valid, as a multiuser box needs to access filesystems by many different users
at the same time).

The way to protect against this is to subnet the network into 2 (or more
subnets). Now this means that the OS/2 box is on one side of the router (ie the
insecure net), and the NFS server is on the other side. Now when the NFS server
gets a request from an IP address that is on the secure (ie local) subnet it
can be reasonably sure it didn't come from the insecure IP subnet. Now have the
NFS server limit the access that a machine on the insecure subnet, and you have
a little security. Not, obviously, to the exports that are accessible to the
insecure subnet where the OS/2 machines are, but at least its a (partial)
solution to NFS's basic (and fundamental) insecurities.

> If anything, being on the network is a risk to the people running
> the OS/2 system, if they have telnet and ftp servers going.  It seems
> much easier to break into the OS/2 system, due to the lack of multi-
> user capability and the accompanying file protections.
> 
> JMC
> -- 
> chandoni@husc8.harvard.edu    | I will not yell fire in a crowded classroom
> John-Marc Chandonia           | I will not yell fire in a crowded classroom
> Graduate Biophysics Program   | I will not yell fire in a crowded classroom 
> Harvard University            | I will not yell fire ...
-- 
==============================================================================
|  Hamish Marson   <h.marson@waikato.ac.nz>                             OS/2 |
|  Programmer (n/5), School of Computing and Mathematical Sciences           | 
|  University of Waikato,                                                    |
|  Hamilton, New Zealand.                                                    |
|Disclaimer:  Anything said in this message is the personal opinion of the   |
|             finger hitting the keyboard & doesn't represent my employers   |
|             opinion in any way. (ie we probably don't agree)               |
==============================================================================
  Q. If Nuclear Tests are so safe, why don't the French do them under Paris?