3 ms·

> NFS ran in plaintext and used the sender’s IP address for authentication and it still does

by Hello71 11y ago

markild 11y ago
There are solutions though[1] [1]: https://wiki.debian.org/NFS/Kerberos https://wiki.debian.org/NFS/Kerberos
- pjc50 11y ago
  Actually getting Kerberos+NFS to work is a huge pain, though. Then there's the consideration of userid mapping.
  - toast0 11y ago
    Userid mapping is easy: Centrally manage the password file, so you don't need to map. Anything else is madness; hopefully you figure this out early, it is painful to fix later.
    - gm3dmo 11y ago
      Too right. The madness arrives when you have to retrofit the mapping and people have used different uid numbers for the same user and different users have the same uid across machines.
DonHopkins 11y ago
It was much worse than that. Back when I was a summer intern at Sun in 1987, it was common knowledge among the engineers at Sun that NFS stood for "No File Security", and the rpc mount protocol would trust the client to tell the server its host name, which the server would look up in /etc/exports to decide how much to trust it. So if you know that Scott McNealy's workstation's name was "doober" (which it was), and it gave permission to a server named "mama", then on any workstation you could type: % hostname mama; mount doober:/usr /mnt; hostname `hostname` And you'd have Scott McNealy's /usr file system mounted. This also worked over the internet!
- smarks 11y ago
  I thought "doober" was Wayne Rosing's machine. (Not that this is of any consequence....) :-)
  - DonHopkins 11y ago
    I grepped some old email, and you're right! My favorite email address from that time was eat@joes.
    - smarks 11y ago
      (WARNING: crusty Sun old-timer memories follow) For those who aren't familiar with this, up until the mid-1990s or so, Sun let individual engineers name their own workstations. In fact many regarded this as a privilege. Each workstation ran its own copy of sendmail, so one's email address was login@hostname. People came up with all kinds of clever login/hostname combinations, such as what Don mentioned, eat@joes. My all time favorite was Rich Burridge's, whose workstation was named "stard". Since his login was richb, his email address was... richb@stard
      - DonHopkins 11y ago
        Speaking of rich bastards, who could forget Rich Morin's "Canta Forda Computer Laboratory"? http://www.cfcl.com/ http://www.cfcl.com/
- tptacek 11y ago
  NFS used to be one of the most popular ways to break into machines on the 1990s Internet. Leendert van Doorn wrote a CLI for NFS that was modified with a bunch of different exploits and passed around among hackers. Everyone who attacked Unix systems in (say) 1995 had a copy of NFS shell.
  - apk17 11y ago
    I wrote one myself. Fun things: 'int getuid() { return 0; }' in the userland code was sufficient for authentication. And the mountd returned the root handle of the file system. When you presented that handle to nfsd it would happily serve you even when you are no longer in the exports table.

> NFS ran in plaintext and used the sender’s IP address for authentication and it still does

by Hello71 11y ago

> NFS ran in plaintext and used the sender’s IP address for authentication and it still does

markild 11y ago

There are solutions though[1] [1]: https://wiki.debian.org/NFS/Kerberos https://wiki.debian.org/NFS/Kerberos

pjc50 11y ago
Actually getting Kerberos+NFS to work is a huge pain, though. Then there's the consideration of userid mapping.
- toast0 11y ago
  Userid mapping is easy: Centrally manage the password file, so you don't need to map. Anything else is madness; hopefully you figure this out early, it is painful to fix later.
  - gm3dmo 11y ago
    Too right. The madness arrives when you have to retrofit the mapping and people have used different uid numbers for the same user and different users have the same uid across machines.

DonHopkins 11y ago

It was much worse than that. Back when I was a summer intern at Sun in 1987, it was common knowledge among the engineers at Sun that NFS stood for "No File Security", and the rpc mount protocol would trust the client to tell the server its host name, which the server would look up in /etc/exports to decide how much to trust it. So if you know that Scott McNealy's workstation's name was "doober" (which it was), and it gave permission to a server named "mama", then on any workstation you could type: % hostname mama; mount doober:/usr /mnt; hostname `hostname` And you'd have Scott McNealy's /usr file system mounted. This also worked over the internet!

smarks 11y ago
I thought "doober" was Wayne Rosing's machine. (Not that this is of any consequence....) :-)
- DonHopkins 11y ago
  I grepped some old email, and you're right! My favorite email address from that time was eat@joes.
  - smarks 11y ago
    (WARNING: crusty Sun old-timer memories follow) For those who aren't familiar with this, up until the mid-1990s or so, Sun let individual engineers name their own workstations. In fact many regarded this as a privilege. Each workstation ran its own copy of sendmail, so one's email address was login@hostname. People came up with all kinds of clever login/hostname combinations, such as what Don mentioned, eat@joes. My all time favorite was Rich Burridge's, whose workstation was named "stard". Since his login was richb, his email address was... richb@stard
    - DonHopkins 11y ago
      Speaking of rich bastards, who could forget Rich Morin's "Canta Forda Computer Laboratory"? http://www.cfcl.com/ http://www.cfcl.com/
tptacek 11y ago
NFS used to be one of the most popular ways to break into machines on the 1990s Internet. Leendert van Doorn wrote a CLI for NFS that was modified with a bunch of different exploits and passed around among hackers. Everyone who attacked Unix systems in (say) 1995 had a copy of NFS shell.
- apk17 11y ago
  I wrote one myself. Fun things: 'int getuid() { return 0; }' in the userland code was sufficient for authentication. And the mountd returned the root handle of the file system. When you presented that handle to nfsd it would happily serve you even when you are no longer in the exports table.