3 ms·
If you a) run NFS on a public IP address, b) use sec=sys, and c) permit connections from any IP, then yes. I think that can't be generalized to "The authorizat
by geofft 6y ago
If you a) run NFS on a public IP address, b) use sec=sys, and c) permit connections from any IP, then yes.
I think that can't be generalized to "The authorization scheme sucks" any more than if you run sshd on a public IP address and permit root logins with a password and pick a guessable password you can conclude that SSH's authorization scheme sucks. There's a number of stronger things you could do and they're perfectly normal.
- tryauuum 6y agoMy main grudge is that NFS authorization is pointless without external crutches like IP-address whitelisting. Maybe it's because I'm used to password-based or key-based authentication methods and when I had met NFS I became scared of that host-based authentication. Of course I agree that IP whitelisting is a good practice that solves and prevents many issues.