NFSSEC(7) Standards, Environments, and Macros NFSSEC(7)
NAME
nfssec - overview of NFS security modes
DESCRIPTION
The
mount_nfs(8) and
share_nfs(8) commands each provide a way to specify
the security mode to be used on an
NFS file system through the
sec=mode option.
mode can be
sys,
dh,
krb5,
krb5i,
krb5p, or
none. These security
modes can also be added to the automount maps. Note that
mount_nfs(8) and
automount(8) do not support
sec=none at this time.
mount_nfs(8) allows
you to specify a single security mode;
share_nfs(8) allows you to specify
multiple modes (or
none). With multiple modes, an NFS client can choose
any of the modes in the list.
The
sec=mode option on the
share_nfs(8) command line establishes the
security mode of
NFS servers. If the
NFS connection uses the
NFS Version
3 protocol, the
NFS clients must query the server for the appropriate
mode to use. If the
NFS connection uses the
NFS Version 2 protocol, then
the
NFS client uses the default security mode, which is currently
sys.
NFS clients may force the use of a specific security mode by specifying
the
sec=mode option on the command line. However, if the file system on
the server is not shared with that security mode, the client may be
denied access.
If the
NFS client wants to authenticate the
NFS server using a particular
(stronger) security mode, the client wants to specify the security mode
to be used, even if the connection uses the
NFS Version 3 protocol. This
guarantees that an attacker masquerading as the server does not
compromise the client.
The
NFS security modes are described below. Of these, the
krb5,
krb5i,
krb5p modes use the Kerberos V5 protocol for authenticating and
protecting the shared filesystems. Before these can be used, the system
must be configured to be part of a Kerberos realm. See
kerberos(7).
sys Use
AUTH_SYS authentication. The user's UNIX user-id and group-
ids are passed in the clear on the network, unauthenticated by
the
NFS server. This is the simplest security method and
requires no additional administration. It is the default used
by Solaris
NFS Version 2 clients and Solaris
NFS servers.
According to the ONC RPC specification (RFC 5531),
AUTH_SYS authentication supports up to 16 groups for a user only. To
workaround this limitation, in the case where the
NFS client
supplied 16 groups in
AUTH_SYS and
NGROUPS_MAX is more than 16,
the
NFS server will lookup the user's groups on the server
instead of relying on the list of groups provided by the
NFS client via
AUTH_SYS.
dh Use a Diffie-Hellman public key system (
AUTH_DES, which is
referred to as
AUTH_DH in the forthcoming Internet
RFC). krb5 Use Kerberos V5 protocol to authenticate users before granting
access to the shared filesystem.
krb5i Use Kerberos V5 authentication with integrity checking
(checksums) to verify that the data has not been tampered with.
krb5p User Kerberos V5 authentication, integrity checksums, and
privacy protection (encryption) on the shared filesystem. This
provides the most secure filesystem sharing, as all traffic is
encrypted. It should be noted that performance might suffer on
some systems when using
krb5p, depending on the computational
intensity of the encryption algorithm and the amount of data
being transferred.
none Use null authentication (
AUTH_NONE).
NFS clients using
AUTH_NONE have no identity and are mapped to the anonymous user
nobody by
NFS servers. A client using a security mode other than the one
with which a Solaris
NFS server shares the file system has its
security mode mapped to
AUTH_NONE. In this case, if the file
system is shared with
sec=none, users from the client are mapped
to the anonymous user. The
NFS security mode
none is supported
by
share_nfs(8), but not by
mount_nfs(8) or
automount(8).
FILES
/etc/nfssec.conf NFS security service configuration file
SEE ALSO
rpc_clnt_auth(3NSL),
secure_rpc(3NSL),
nfssec.conf(5),
attributes(7),
kerberos(7),
automount(8),
kclient(8),
mount_nfs(8),
share_nfs(8)NOTES
/etc/nfssec.conf lists the
NFS security services. Do not edit this file.
It is not intended to be user-configurable. See
kclient(8).
November 20, 2014
NFSSEC(7)