While file sharing using the Network File System (NFS) currently supports cryptography, this has not always been the case. In addition, it is necessary to be aware of how cryptography is implemented, what it means. Does it address data confidentiality, data integrity, or is it at the core of authentication mechanisms? Answering these questions is not easy. NFS only began to address them in advanced versions around 2000. For these reasons, the main problems are the protection of integrity and confidentiality. These problems have solutions, but it is necessary to get rid of old versions that do not support this functionality.
The original NFS was created around 1983 in SUN's development department and was intended to provide file sharing across different systems. Bad Languages claim that NFS is short for No File Security, and it was certainly true for early versions.
But with the advent of NFSv4, security took on a higher priority. Although there was no new encryption standard at first, at least the DES algorithm was used, later other algorithms were added. Encryption was tied to the Kerberos protocol. While NFS has slightly receded from being the majority platform, it is still an important protocol. It is supported on *NIX systems, various shared disk storage, so it is important to know the limitations and ensure appropriate settings. Below is an overview of the different NFS versions and their functionalities.
Version | Year | Protocols | Features | Accounts |
NFSv1 | 1994 | UDP | Basic file sharing 32-bit filesystem structure with files <2GB Basic authentization |
Local |
NFSv2 (RFC 1049) |
1989 | UDP | Basic file sharing 32-bit filesystem structure with files <2GB Basic authentization with: - UID and GID (transported over network) - NIS/YP Support for UDP transportFeatures |
Local NIS |
NFSv3 (RFC 1813 |
1995 | 2049/udp 2049/tcp |
64-bit filesystem structure with files >2GB Asynchronous operations Support for symbolic links Support for hardlinks Support for large block transport Filesystem metadata support Support for TCP transport Support for NULL authenticationBasic authentization with: - UID and GID (transported over network) - NIS/YP - NIS+ Support for local authentication mechanisms |
Local NIS/NIS+ LDAP |
WebNFS | 1996 | 2049/tcp | Extension of NFSv2/NFSv3 Support for TCP transport (WITHOUT TLS, REQUIRE VPN) |
Local NIS/NIS+ LDAP |
NFSv4 (RFC 3010) (RFC 3530) |
2000 | 2049/tcp | Full TCP support (without UDP) Statefull connection Support for file locking Supported ACL and rights delegation Chaining commands in single request Support Kerberos authentication Support encryption (based on Kerberos) |
Local NIS/NIS+ LDAP |
NFSv4.1 (RFC 5661) (RFC 8881) |
2010 | 2049/tcp | Parallel NFS (NFSp - access parallelization) Better scalling, load balancing and availability Better client and server management |
Local NIS/NIS+ LDAP |
NFSv4.2 (RFC 7862) |
2016 | 2049/tcp | Support for Server side copy Support for Sparse files Better data checksums Support NFS over TLS (NFSs) Support Integrity Measurement Architecture (IMA - metadata) |
Local NIS/NIS+ LDAP |
Ensuring encryption and integrity checks uses the algorithm chosen when negotiating using the Kerberos protocol. NFS supports only this method to ensure protection of negotiations. The negotiated mechanisms then allow to determine the data encryption algorithm and the cryptographic checksum, where support for each algorithm is listed in the following table.
Type | Algorithms | NFSv1 | NFSv2 | NFSv3 | NFSv4 | NFSv4.1 | NFSv4.2 |
0x01 | des-cbc-crc (weak) | - | - | - | Yes | Yes | Yes |
0x02 | des-cbc-md4 (weak) | - | - | - | Yes | Yes | Yes |
0x03 | des-cbc-md5 (weak) | - | - | - | Yes | Yes | Yes |
0x04 | reserved (slabé) | - | - | - | - | - | - |
0x05 | des3-cbc-md5 (weak) | - | - | - | - | - | - |
0x06 | reserved (slabé) | - | - | - | - | - | - |
0x07 | des3-cbc-sha1 (weak) | - | - | - | Yes | Yes | Yes |
0x09 | DSAWithSHA1-CmsOID | - | - | - | - | - | - |
0x0a | MD5WithRSAEncryption-CmsOID | - | - | - | - | - | - |
0x0b | SHA1WithRSAEncryption-CmsOID | - | - | - | - | - | - |
0x0c | rc2-cbc-sha1 (weak) | - | - | - | - | - | - |
0x0d | RSAEncryption-EnvOID | - | - | - | - | - | - |
0x0e | RSAES-OAEP-EnvOID | - | - | - | - | - | - |
0x0f | des-ede3-cbc (weak) | - | - | - | - | - | - |
0x10 | des3-cbc-sha1-kd | - | - | - | - | - | - |
0x11 | aes128-cts-hmac-sha1-96 (obsolete) | - | - | - | - | Yes | Yes |
0x12 | aes256-cts-hmac-sha1-96 (obsolete) | - | - | - | - | Yes | Yes |
0x13 | aes128-cts-hmac-sha256-128 | - | - | - | - | Yes | Yes |
0x14 | aes256-cts-hmac-sha384-192 | - | - | - | - | Yes | Yes |
0x17 | arcfour-hmac / rc4-hmac (weak) | - | - | - | Yes | Yes | Yes |
0x18 | arcfour-hmac-ext / rc4-hmac-exp (40b key, weak) | - | - | - | Yes | Yes | Yes |
0x19 | camellia128-cts-chmac | - | - | - | - | Yes | Yes |
0x20 | camellia256-cts-cmac | - | - | - | - | Yes | Yes |
0x41 | subkey-keymaterial | - | - | - | - | - | - |
Starting NFS on the server side with secured protection requires a functioning Kerberos, preferably tied to some LDAP system for authentication. Since the most commonly used LDAP system at present is Active Directory, it is advisable to use this system and provide central user management.
To configure on the server side, you must load a set of installation packages, in this case for debian-based distributions:
# apt install realmd krb5-user adcli sssd samba-common nfs-kernel-server gssproxy -y
The /etc/krb5.conf file must contain:
[libdefaults]
default_realm = NFS.Domain
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
allow_weak_crypto= false
default_tkt_enctypes = aes256-cts-hmac-sha1-96
[realms]
NFS.DOMAIN = {
kdc = ADServerName.NFS.Domain
admin_server = ADServerName.NFS.Domain
default_domain = nfs.domain
}
[domain_realm]
.NFS.Domain = NFS.Domain
NFS.Domain = NFS.Domain
Where the ADServerName item is the Active Directory name of the server and the NFS.Domain is the domain name in which the NFS is provided. Thanks to the NSS, a domain can be e.g. a DNS domain. Within the configuration, it is possible to define the type of encryption required, where AD currently only supports RC4 and AES-CTS with integrity check using SHA1 (on top of that, trimmed from 160 bits to 96 bits). However, specifying the required encryption may conflict with the defined policy, in which case it will not be possible to connect.
The /etc/nfs.conf file must contain:
[gssd]
use-gss-proxy=1
The /etc/default/nfs-common file must contain:
NEED_GSSD="yes"
You also need to enter the following commands from the shell environment to initialize the shell environment:
# kinit Administrator
# realm discover NFS.Domain
# realm join --user-principal=linuxnfsuser/ThisMachineFQDN@NFS.Domain NFS.Domain
For NFS server it is necessary to enter
# realm join --user-principal=linuxnfsuser/kerberos-nfsserver.NFS.Domain@NFS.Domain NFS.Domain
For NFS client it is necessary to enter
# realm join --user-principal=linuxnfsuser/kerberos-nfsclient.NFS.Domain@NFS.Domain NFS.Domain
For proper functionality it is necessary to add corresponding records for the NFS server (kerberos-nfsserver) and for the NFS client (kerberos-nfsclient). In this case, these records are at addresses 192.168.1.10 and 192.168.1.11, they must refer to the NS domain NFS.Domain.
# Add-DnsServerResourceRecordA -CreatePtr -Name kerberos-nfsserver -IPv4Address 192.168.1.10 -ZoneName NFS.Domain
# Add-DnsServerResourceRecordA -CreatePtr -Name kerberos-nfsclient -IPv4Address 192.168.1.11 -ZoneName NFS.Domain
You also need to set the Service Principal Name for NFS:
# setspn -S linuxnfsuser/ThisMachineFQDN kerberos-nfsserver
# setspn -S linuxnfsuser/ThisMachineFQDN kerberos-nfsclient
# setspn -L kerberos-nfsserver
# setspn -L kerberos-nfsclient
This completes the configuration of DNS records and SPNs, further it is possible to continue with the configuration of NFS server and NFS client.
Since we have Linux associated with Active Directory using Kerberos and created SPNs, it is possible to start configuring your own NFS server for sharing.
The /etc/exports file must contain the following definitions for /nfsshare folder sharing:
/nfsshare gss/krb5p(rw,sync)
Where the following encryption set transfer from Kerberos ticket is valid for cryptographic protection settings:
- krb5: Authentication
- krb5i: Authentication and integrity
- krb5p: Authentication, Integrity and Encryption
It is then necessary to restart NFS services from the command line:
# service rpc-gssd restart
# service gssproxy restart
# service nfs-kernel-server restart
# /etc/init.d/nfs-common restart
After setting up the NFS server and providing the shared folder, it is possible to allow the client to connect to the NFS server. This requires the following series of modifications:
# apt install nfs-common gssproxy -y
In /etc/nfs.conf you need to set:
use-gss-proxy=1
In /etc/default/nfs-common you need to set:
NEED_GSSD="yes"
In /etc/gssproxy/99-nfs-client.conf you need to set:
[service/nfs-server]
mechs = krb5
socket = /run/gssproxy.sock
cred_store = keytab:/etc/krb5.keytab
cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_%U
cred_store = client_keytab:/var/lib/gssproxy/clients/%U.keytab
cred_usage = initiate
allow_any_uid = yes
trusted = yes
kernel_nfsd = yes
euid = 0
It is then necessary to restart the services associated with providing the NFS function of the client:
# service rpc-gssd restart
# service gssproxy restart
# /etc/init.d/nfs-common restart
Finally, you can attach a folder from the server side:
# mount -t nfs4 -o sec=krb5p kerberos-nfsserver.nfs.domain:/nfsshare /mnt
If you need to provide the user side with Kerberos token recovery automation, you can enter a command in the .profile file to provide the service:
/usr/bin/kinit KRB-CLT$ -t /etc/krb5.keytab
1. Introductory Provisions
1.1. These General Terms and Conditions are, unless otherwise agreed in writing in the contract, an integral part of all contracts relating to training organised or provided by the trainer, Jan Dušátko, IČ 434 797 66, DIČ 7208253041, with location Pod Harfou 938/58, Praha 9 (next as a „lector“).2. Creation of a contract by signing up for a course
2.1. Application means unilateral action of the client addressed to the trainer through a data box with identification euxesuf, e-mailu with address register@cryptosession.cz or register@cryptosession.info, internet pages cryptosession.cz, cryptosession.info or contact phone +420 602 427 840.3. Termination of the contract by cancellation of the application
3.1. The application may be cancelled by the ordering party via e-mail or via a data mailbox.4. Price and payment terms
4.1. By sending the application, the ordering party accepts the contract price (hereinafter referred to as the participation fee) indicated for the course.5. Training conditions
5.1. The trainer is obliged to inform the client 14 days in advance of the location and time of the training, including the start and end dates of the daily programme.6. Complaints
6.1. If the participant is grossly dissatisfied with the course, the trainer is informed of this information.7. Copyright of the provided materials
7.1. The training materials provided by the trainer in the course of the training meet the characteristics of a copyrighted work in accordance with Czech Act No 121/2000 Coll.8. Liability
8.1. The trainer does not assume responsibility for any shortcomings in the services of any third party that he uses in the training.9. Validity of the Terms
9.1 These General Terms and Conditions shall be valid and effective from 1 October 2024.Consent to the collection and processing of personal data
According to Regulation (EU) No 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as "the Regulation"), the processor xxx (hereinafter referred to as "the Controller") processes personal data. Individual personal data that are part of the processing during specific activities at this web presentation and in the course of trade are also broken down.Information about the records of access to the web presentation
This website does not collect any cookies. The site does not use any analytical scripts of third parties (social networks, cloud providers). For these reasons, an option is also offered for displaying the map in the form of a link, where the primary source is OpenStreet and alternatives then the frequently used Maps of Seznam, a.s., or Google Maps of Google LLC Inc. The use of any of these sources is entirely at the discretion of the users of this site. The administrator is not responsible for the collection of data carried out by these companies, does not provide them with data about users and does not cooperate on the collection of data.Information about contacting the operator of the site
The form for contacting the operator of the site (administrator) contains the following personal data: name, surname, e-mail. These data are intended only for this communication, corresponding to the address of the user and are kept for the time necessary to fulfil the purpose, up to a maximum of one year, unless the user determines otherwise.Information about the order form
In case of an interest in the order form, the form contains more data, i.e. name, surname, e-mail and contact details for the organisation. These data are intended only for this communication, corresponding to the address of the user and are kept for one year, unless the user determines otherwise. In the event that a business relationship is concluded on the basis of this order, only the information required by Czech law on the basis of business relations (company name and address, bank account number, type of course and its price) will continue to be kept by the administrator.Information about the course completion document
Within the course, a course completion document is issued by the processor. This document contains the following data: student's name and surname, the name and date of the course completion and the employer's name. The information is subsequently used for the creation of a linear hash tree (non-modifiable record). This database contains only information about the provided names and company names, which may or may not correspond to reality and is maintained by the processor for possible re-issuance or verification of the document's issuance.Rights of the personal data subject
The customer or visitor of this website has the possibility to request information about the processing of personal data, the right to request access to personal data, or the right to request the correction or deletion of any data held about him. In the case of deletion, this requirement cannot be fulfilled only if it is not data strictly necessary in the course of business. The customer or visitor of this website also has the right to obtain explanations regarding the processing of his personal data if he finds out or believes that the processing is carried out in violation of the protection of his private and personal life or in violation of applicable legislation, and the right to request removal of the resulting situation and to ensure the correction.