3 ms·

The authorization scheme sucks.

• Proven 6y ago
  As opposed to what?
• geofft 6y ago
  Can you expand on that? Which authorization scheme are you thinking of? I've run global-scale NFS deployments with sec=sys before and I wouldn't say it sucked.
  • tryauuum 6y ago
    so say if you have an NFS share (server A) on a public IP-address, and NFS client (server B), that mounts an NFS share with that sec=sys option. Doesn't that mean that a rogue server C can connect to server A and impersonate any user?
    • geofft 6y ago
      If you a) run NFS on a public IP address, b) use sec=sys, and c) permit connections from any IP, then yes. I think that can't be generalized to "The authorization scheme sucks" any more than if you run sshd on a public IP address and permit root logins with a password and pick a guessable password you can conclude that SSH's authorization scheme sucks. There's a number of stronger things you could do and they're perfectly normal.
      • tryauuum 6y ago
        My main grudge is that NFS authorization is pointless without external crutches like IP-address whitelisting. Maybe it's because I'm used to password-based or key-based authentication methods and when I had met NFS I became scared of that host-based authentication. Of course I agree that IP whitelisting is a good practice that solves and prevents many issues.