[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: NFS setup problems

Hi, nate writes:
Hi Folks, 
I have been trying to setup NFS on my system and run into problems. I have
been reading the security part of NFS-HOWTO.



however there a bunhc of lines of portmap status, nfs nlockmgr mountd hat
are listed when rpcinfo -p is run.
I have recompiled the kernel for NFSv3 support and I have nfs-common and
nfs-kernel-server install. quota is also installed.


I don't understand. Your having problems, and yet rpcinfo -p shows the
correct info? If you have full NFS services running, and your system
is allowed access, running rpcinfo -p SHOULD show a bunch of stuff.
What mount command line are you using, and what is the message that you
see(if any) when you try to mount, and what does the log say on the
server?
I am able to mount the directories. There is no problem there. My problem is this <quote from NFS-HOWTO section on security> 
Assuming your portmapper is /sbin/portmap you can
 check it with this command:
strings /sbin/portmap | grep hosts. 
 On a securable machine it comes up something like this:
 /etc/hosts.allow
 /etc/hosts.deny
 @(#) hosts_ctl.c 1.4 94/12/28 17:42:27
@(#) hosts_access.c 1.21 97/02/12 02:13:22 </quote> when i run the above command i get only the following output hosts_ctl Which according to the document is that /etc/hosts.deny and /etc/hosts.allow are not beting read or I am assuming so since the correct output is not there. 


I really do not trust the tcp_wrappers(hosts.allow/deny), I don't know
why, just paranoia maybe. I much prefer to firewall the ports entirely. I run 2.2.19 and this is what I use: PORTS="`rpcinfo -p | awk '{print $4}' | grep '[0-9]'`" 
for rpcport in $PORTS
do
/sbin/ipchains -A input -s 0/0 -d 0/0 $rpcport -j REJECT -p tcp -i eth0
/sbin/ipchains -A input -s 0/0 -d 0/0 $rpcport -j REJECT -p udp -i eth0
done then I have the ports blocked again on my exterior firewall.
Thank you for this suggestion. I shall try it out. My knowledge is these areas is close to non-existant. I shall have a look at the howto's for setting up a firewall.
Reply to: