At 12:52 PM 2/7/2007, Arthur Pemberton wrote:
>>It was a while ago when I read that NFS was difficult to secure with (the
>>use of) ssh and iptables (or something like that).
>>
>>I really needed an alternative that works and can be made secure.
>> If not, what is the closest thing to NFS?
>Subdue NFS to use only one port, firewall all other ports
>off....possible filter the NFS port too?
That is what I read and I was looking for an alternative to that. Is there
other solution? Or this is the best available solution already?
Well, if you can suggest how the solution could be made better, I or
others can maybe suggest how to implement it.
The only other thing i can think of is have port mapper interface with
iptables in a plug and play type firewall way (or however Windows
refers to it)
At 01:52 PM 2/7/2007, Olivier Galibert wrote:
What is your threat model? What do you want to be secured against?
OG.
At 02:04 PM 2/7/2007, Lamont Peterson wrote:
Kerberized NFS, preferably NFS4.
AndrewFS or CodaFS.
Thanks everybody for replying!
I am hoping for a secure solution to mount directories "shared out" from my
other computer located remotely over the Internet. So that I can edit
source files and execute programs "locally" and compile remotely (a much
faster machine).
Whether I go with subdued NFS or NFS4, I will have to secure the
communication channels with ssh tunnels and doing it the ad-hoc way
(scripted) is a lot of hassles for daily use with connection that can get
cut once in a while (daily, for example.)
Without a secure solution, I would just use scp (and possibly develop other
solutions to sync files.)
With Fedora Core's iptables policies and selinux, I feel secure leaving
computers exposed to the Internet, knowing that I won't ending up
suspecting a breach and spending a lot of time dealing with it. It would be
regrettable to use a network service (likes NFS without ssh tunnels) that
makes me feel uncertain and insecure. The peace of mind is invaluable.
I have at most read about AFS (and used it as an end user in an
administered environment) and CodaFS, but don't know if encryption of
network communication is built in or integrated. I suspect not. (Haven't
done the research yet...)
Is NFS(4) still the best (and easiest-to-use?) solution?
Thanks.
--
Daniel Yek
--
fedora-devel-list mailing list
fedora-devel-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-devel-list
