The NFS protocol provides various authentication methods to ensure secure access to network file systems. One of the authentication methods, AUTH_SYS, relies on untrusted user IDs, while Kerberos offers cryptographic verification for enhanced security.
However, configuring Kerberos on Linux systems can be complex, prompting the development of new standards like RPC over TLS. By leveraging TLS for authentication and encryption, similar to HTTPS, RPC over TLS aims to simplify secure NFS access.
In order to limit access and prevent unauthorized connections, NFS servers restrict client connections to specific ports, requiring root privileges or special capabilities. This security measure aims to enhance security by controlling access to the NFS server.
Despite the strong security offered by Kerberos authentication, Linux NFS servers may face limitations. Unlike Windows servers, which accept connections from any port, Linux servers have restrictions in place. This makes the security mechanism largely obsolete in modern environments.
Linux NFS servers utilize squashing to control access permissions, mapping incoming user IDs to different IDs on the server to enhance security. Common squashing options include "all_squash," "root_squash," and "no_root_squash," addressing the issue of inconsistent user IDs between client and server systems.
NFS exports can also restrict access to specific hosts using IP addresses, subnets, or hostnames, enabling granular control over permissions for each host. However, security heavily relies on properly configured allowed networks and regular review of allowed IPs and hostnames.
Tools like showmount on Linux systems help gather information about NFSv3 servers, including available exports, access permissions, and connected clients. For NFSv4, clients directly attempt to access exports under the / directory, enforcing access control at that level.
Existing NFS assessment tools, such as Metasploit and nmap, lack comprehensive functionality and support for modern NFS versions like NFSv4. This necessitates more advanced techniques for identifying and accessing exports in modern NFS environments.
Attackers can exploit NFS weak authentication, often relying on AUTH_SYS, to gain unauthorized access to remote files. By impersonating users or groups with the necessary permissions, attackers can bypass intended access controls and gain unauthorized access to sensitive data.
fuse_nfs, a FUSE driver for NFS, allows unrestricted file access by automatically setting necessary user and group IDs for each file. This enables users to access files within their permissions on NFS shares, regardless of server-side authentication methods like Kerberos.
HVS Consulting analyzes NFS security from an offensive perspective, identifying common misconfigurations and vulnerabilities in Linux NFS implementations. The lack of adequate logging and detection mechanisms in these implementations makes it challenging to identify and mitigate risks effectively.
To secure NFS, it is recommended to restrict access to necessary clients, use NFSv4 with ACLs, export from root directories or enable subtree_check, avoid bind mounts and nested exports, mount with nosuid and nodev, disable no_root_squash, enable all_squash, prioritize Kerberos authentication, and use firewalls and network segmentation to control access effectively.