Adam Bower wrote:
Yeah but the network is firewalled so it is not a problem, most big ISP's use NFS for serving webpages from NetApp's and big Sun's (trust me on this). I would also argue you are completly wrong about using Samba instead.
that depends on who you trust, some organisations I have worked in have firewalls and then assume that they are safe so they drop all internal security.. when they get unwanted access from within, people go ape and ask why!!
It can be argued either way, I'm a little paranoid about these kind of things...
I am deadly serious.. NFS assumes that the client is responsible for the authentication, and therefore anybody who has root access on a linux box can 'become' another use, and mount their files, not very secure!!!...
Aah there are some very simple ways of spoofing with the M$ protocols, I know which one I would choose, also it you look at the man pages for nfs you can see it is very easy enable some fairly strong access controls.
I have no doubt that it could be spoofed, but to be honest most machines that get broken into are due to misconfigurations or failure to apply security patches.. In this case I am just highlighting a problem that occurs with nfs which many people seem to either not know about or ignore.. as for access controls, they are present in many of the networked files systems around (including nfs and samba)
Samba, although used by MS, was designed with the authentication stage in the server, thus getting around this problem.. Between NFS and SMB, SMB is more secure (not to mention faster!)...
SMB faster than NFS?!?! I really don't think so.
In the "tests" I have done this is how it seems. I admit that it is really down to configurations/server load etc.. but as far as I can tell it is faster than nfs.. perhaps I should reinforce this statement by saying linux kernel 2.2 nfs, with 15 'average' users... kernel 2.0 nfs is not even worth arguing about, I haven't played with 2.4 nfs yet...
Also the way passwords get chucked around the network with SMB is dangerously insecure as If you grab a copy of L0phtcrack and a packet sniffer you can get them dead easily, or if you are on a switched network you can easily craft a message to exploit SMB.
so are you saying that being able to "su username" and reading files over nfs is more complicated than cranking up l0phtcrack?.... hhmmm actually you might be right there ;)...
as for spoofing, any non-encrypted protocol can be spoofed, the compexities of which protocol is easier is another matter though ;).. if I had my way I would shove nfs or samba over ssl.. but the client support is somewhat lacking ;(...
SMB doesn't support real host access controls which NFS does, this makes a big difference in real security.
unless I have misunderstood your comment, check the "hosts allow" option of the smb.conf man page....
There are some other network filessystems (such as Coda) which may be better than SMB, but I don't really know much about them...
Coda is a really good idea, just not quite there yet most of the people I know who have used it have reported the same as me and that it breaks severely at random.
yeah, I had that problem with coda a while ago so I didn't look at it further.. when it is stable (which I hope is sometime soon) I will be looking into it again......
btw, this email isn't meant as a flame, I just hope that others can gather information from this discussion to make an informed decision....
Regards Sz
Adam
Adam Bower, abower@zeus.com Tel: +44 1223 525000 System Administrator Fax: +44 1223 525100 Zeus Technology Ltd http://www.zeus.com Zeus House, Cowley Road Cambridge CB4 0ZT England
alug, the Anglian Linux User Group list Send list replies to alug@stu.uea.ac.uk http://rabbit.stu.uea.ac.uk/cgi-bin/listinfo/alug See the website for instructions on digest or unsub!