7 ms·
Can you expand on that / why not? It's certainly possible to use NFS in places where other tools would work better, but if the thing you actually want is filesy
by geofft 6y ago
Can you expand on that / why not? It's certainly possible to use NFS in places where other tools would work better, but if the thing you actually want is filesystem semantics from multiple clients, NFS is definitely one of your better options, as far as I know / in my experience.
- tryauuum 6y agoThe authorization scheme sucks.
- Proven 6y agoAs opposed to what?
- geofft 6y agoCan you expand on that? Which authorization scheme are you thinking of? I've run global-scale NFS deployments with sec=sys before and I wouldn't say it sucked.
- tryauuum 6y agoso say if you have an NFS share (server A) on a public IP-address, and NFS client (server B), that mounts an NFS share with that sec=sys option. Doesn't that mean that a rogue server C can connect to server A and impersonate any user?
- geofft 6y agoIf you a) run NFS on a public IP address, b) use sec=sys, and c) permit connections from any IP, then yes. I think that can't be generalized to "The authorization scheme sucks" any more than if you run sshd on a public IP address and permit root logins with a password and pick a guessable password you can conclude that SSH's authorization scheme sucks. There's a number of stronger things you could do and they're perfectly normal.
- tryauuum 6y agoMy main grudge is that NFS authorization is pointless without external crutches like IP-address whitelisting. Maybe it's because I'm used to password-based or key-based authentication methods and when I had met NFS I became scared of that host-based authentication. Of course I agree that IP whitelisting is a good practice that solves and prevents many issues.