nfssec(5)

NAME | DESCRIPTION | FILES | ATTRIBUTES | SEE ALSO | NOTES

NAME

nfssec- overview of NFS security modes

DESCRIPTION

The mount_nfs(1M) and share_nfs(1M) commands each provide a way to specify the security mode to be used on an NFS file system through the sec=mode option. mode can be either sys, dh, krb4, or none. These security modes may also be added to the automount maps. Note that mount_nfs(1M) and automount(1M) do not support sec=none at this time.

The sec=mode option on the share_nfs(1M) command line establishes the security mode of NFS servers. If the NFS connection uses the NFS Version 3 protocol, the NFS clients must query the server for the appropriate mode to use. If the NFS connection uses the NFS Version 2 protocol, then the NFS client will use the default security mode, which is currently sys. NFS clients may force the use of a specific security mode by specifying the sec=mode option on the command line. However, if the file system on the server is not shared with that security mode, the client may be denied access.

If the NFS client wants to authenticate the NFS server using a particular (stronger) security mode, the client will want to specify the security mode to be used, even if the connection uses the NFS Version 3 protocol. This guarantees that an attacker masquerading as the server does not compromise the client.

The NFS security modes are described as follows:

sys

Use AUTH_SYS authentication. The user's UNIX user-id and group-ids are passed in the clear on the network, unauthenticated by the NFS server. This is the simplest security method and requires no additional administration. It is the default used by Solaris NFS Version 2 clients and Solaris NFS servers.

dh

Use a Diffie-Hellman public key system ( AUTH_DES, which is referred to as AUTH_DH in the forthcoming Internet RFC).

krb4

Use the Kerberos Version 4 authentication system ( AUTH_KERB, which is referred to as AUTH_KERB4 in a forthcoming Internet RFC).

none

Use null authentication ( AUTH_NONE). NFS clients using AUTH_NONE have no identity and are mapped to the anonymous user nobody by NFS servers. A client using a security mode other than the one with which a Solaris NFS server shares the file system will have its security mode mapped to AUTH_NONE. In this case, if the file system is shared with sec=none, users from the client will be mapped to the anonymous user. The NFS security mode none is supported by share_nfs(1M), but not by mount_nfs(1M) or automount(1M).

FILES

/etc/nfssec.conf

NFS security service configuration file.

ATTRIBUTES

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWcsu

SEE ALSO

automount(1M), mount_nfs(1M), share_nfs(1M), rpc_clnt_auth(3N), secure_rpc(3N), attributes(5)

NOTES

/etc/nfssec.conf lists the NFS security services. Do not edit this file. It is not intended to be user-configurable.

SunOS 5.7  Last Revised 10 Mar 1997

NAME | DESCRIPTION | FILES | ATTRIBUTES | SEE ALSO | NOTES