NFSSEC(7) | Standards, Environments, and Macros | NFSSEC(7) |
nfssec - overview of NFS security modes
The mount_nfs(8) and share_nfs(8) commands each provide a way to specify the security mode to be used on an NFS file system through the sec=mode option. mode can be sys, dh, krb5, krb5i, krb5p, or none. These security modes can also be added to the automount maps. Note that mount_nfs(8) and automount(8) do not support sec=none at this time. mount_nfs(8) allows you to specify a single security mode; share_nfs(8) allows you to specify multiple modes (or none). With multiple modes, an NFS client can choose any of the modes in the list.
The sec=mode option on the share_nfs(8) command line establishes the security mode of NFS servers. If the NFS connection uses the NFS Version 3 protocol, the NFS clients must query the server for the appropriate mode to use. If the NFS connection uses the NFS Version 2 protocol, then the NFS client uses the default security mode, which is currently sys. NFS clients may force the use of a specific security mode by specifying the sec=mode option on the command line. However, if the file system on the server is not shared with that security mode, the client may be denied access.
If the NFS client wants to authenticate the NFS server using a particular (stronger) security mode, the client wants to specify the security mode to be used, even if the connection uses the NFS Version 3 protocol. This guarantees that an attacker masquerading as the server does not compromise the client.
The NFS security modes are described below. Of these, the krb5, krb5i, krb5p modes use the Kerberos V5 protocol for authenticating and protecting the shared filesystems. Before these can be used, the system must be configured to be part of a Kerberos realm. See kerberos(7).
sys
According to the ONC RPC specification (RFC 5531), AUTH_SYS authentication supports up to 16 groups for a user only. To workaround this limitation, in the case where the NFS client supplied 16 groups in AUTH_SYS and NGROUPS_MAX is more than 16, the NFS server will lookup the user's groups on the server instead of relying on the list of groups provided by the NFS client via AUTH_SYS.
dh
krb5
krb5i
krb5p
none
/etc/nfssec.conf
rpc_clnt_auth(3NSL), secure_rpc(3NSL), nfssec.conf(5), attributes(7), kerberos(7), automount(8), kclient(8), mount_nfs(8), share_nfs(8)
/etc/nfssec.conf lists the NFS security services. Do not edit this file. It is not intended to be user-configurable. See kclient(8).
November 20, 2014 | OmniOS |