NIS and NFS

NIS and NFS

[Jorge R . Csapo]

Hi all, I've been wrecking my brains over this one but I'm threading water:

I have a Linux-only network with one server and a number of stations. The
server's /home directory is exported and mounted by the stations via NFS. The
server also serves NIS and the setup lets users log onto any one of the
stations and have the same /home/~user everywhere.

My problem is that every user is 'root' at his/her own station. Of course NFS
has been configured not to grant access to remote root users, but there's
nothing to prevent users from 'becoming' someone else with su and then the
NFS/NIS authentication scheme falls flat on its face.

For instance:

. User 'jdoe' logs onto his own station. He's authenticated via NIS and mounts
  /home from the server.
. jdoe then runs 'su' and becomes root.
. root runs 'su - jblow' and becomes jblow.
. jblow cds to /home/jblow...

After going through man docs, howtos and google entries for NIS, NFS and su and
drawing a blank, I'd appreciate any and all insights you people may have on
the subject.

TIA,

-- 
Jorge R. Csapo
--------------------------------------------------
 /"\
 \ / CAMPANHA DA FITA ASCII - CONTRA MAIL HTML
  X  ASCII RIBBON CAMPAIGN - AGAINST HTML MAIL
 / \
--------------------------------------------------
http://www.completo.com.br/~jorge
===========================================
With a PC, I always felt limited
by the software available.
On Unix, I am limited only by my knowledge.
--Peter J. Schoenster

Re: NIS and NFS

[Michael Salmon]

--On 2003-03-25 14.41.05 -0200 "Jorge R . Csapo" <jorge@completo.com.br> 
wrote:

> Hi all, I've been wrecking my brains over this one but I'm threading
> water:
>
> I have a Linux-only network with one server and a number of stations. The
> server's /home directory is exported and mounted by the stations via NFS.
> The server also serves NIS and the setup lets users log onto any one of
> the stations and have the same /home/~user everywhere.
>
> My problem is that every user is 'root' at his/her own station. Of course
> NFS has been configured not to grant access to remote root users, but
> there's nothing to prevent users from 'becoming' someone else with su and
> then the NFS/NIS authentication scheme falls flat on its face.
>
> For instance:
>
> . User 'jdoe' logs onto his own station. He's authenticated via NIS and
> mounts   /home from the server.
> . jdoe then runs 'su' and becomes root.
> . root runs 'su - jblow' and becomes jblow.
> . jblow cds to /home/jblow...
>
> After going through man docs, howtos and google entries for NIS, NFS and
> su and drawing a blank, I'd appreciate any and all insights you people
> may have on the subject.

Your analysis is quite correct, your clients cannot be trusted and hence 
you cannot allow them to mount your server if you care about security. You 
have a few choices, one is to use a beter form of authentication than just 
hostname (e.g. kerberos), unfortunately Linux does not appear to support 
this. The simplest approach is to export the directories using samba and 
mount them with smbmount. You could also look at sfs <http://fs.net> or 
perhaps afs/arla.

/Michael
--
This space intentionally left non-blank.

Re: NIS and NFS

[Michael Salmon]

--On 2003-03-25 14.41.05 -0200 "Jorge R . Csapo" <jorge@completo.com.br> 
wrote:

> Hi all, I've been wrecking my brains over this one but I'm threading
> water:
>
> I have a Linux-only network with one server and a number of stations. The
> server's /home directory is exported and mounted by the stations via NFS.
> The server also serves NIS and the setup lets users log onto any one of
> the stations and have the same /home/~user everywhere.
>
> My problem is that every user is 'root' at his/her own station. Of course
> NFS has been configured not to grant access to remote root users, but
> there's nothing to prevent users from 'becoming' someone else with su and
> then the NFS/NIS authentication scheme falls flat on its face.
>
> For instance:
>
> . User 'jdoe' logs onto his own station. He's authenticated via NIS and
> mounts   /home from the server.
> . jdoe then runs 'su' and becomes root.
> . root runs 'su - jblow' and becomes jblow.
> . jblow cds to /home/jblow...
>
> After going through man docs, howtos and google entries for NIS, NFS and
> su and drawing a blank, I'd appreciate any and all insights you people
> may have on the subject.

Your analysis is quite correct, your clients cannot be trusted and hence 
you cannot allow them to mount your server if you care about security. You 
have a few choices, one is to use a beter form of authentication than just 
hostname (e.g. kerberos), unfortunately Linux does not appear to support 
this. The simplest approach is to export the directories using samba and 
mount them with smbmount. You could also look at sfs <http://fs.net> or 
perhaps afs/arla.

/Michael
--
This space intentionally left non-blank.

Re: NIS and NFS

[Jorge R . Csapo]

tks Michael, I'll look into it.

Jorge

assim falou Michael Salmon (em 25/03/2003):
> --On 2003-03-25 14.41.05 -0200 "Jorge R . Csapo" <jorge@completo.com.br> 
> wrote:
> 
> > Hi all, I've been wrecking my brains over this one but I'm threading
> > water:
> >
> > I have a Linux-only network with one server and a number of stations. The
> > server's /home directory is exported and mounted by the stations via NFS.
> > The server also serves NIS and the setup lets users log onto any one of
> > the stations and have the same /home/~user everywhere.
> >
> > My problem is that every user is 'root' at his/her own station. Of course
> > NFS has been configured not to grant access to remote root users, but
> > there's nothing to prevent users from 'becoming' someone else with su and
> > then the NFS/NIS authentication scheme falls flat on its face.
> >
> > For instance:
> >
> > . User 'jdoe' logs onto his own station. He's authenticated via NIS and
> > mounts   /home from the server.
> > . jdoe then runs 'su' and becomes root.
> > . root runs 'su - jblow' and becomes jblow.
> > . jblow cds to /home/jblow...
> >
> > After going through man docs, howtos and google entries for NIS, NFS and
> > su and drawing a blank, I'd appreciate any and all insights you people
> > may have on the subject.
> 
> Your analysis is quite correct, your clients cannot be trusted and hence 
> you cannot allow them to mount your server if you care about security. You 
> have a few choices, one is to use a beter form of authentication than just 
> hostname (e.g. kerberos), unfortunately Linux does not appear to support 
> this. The simplest approach is to export the directories using samba and 
> mount them with smbmount. You could also look at sfs <http://fs.net> or 
> perhaps afs/arla.
> 
> /Michael
> --
> This space intentionally left non-blank.

-- 
Jorge R. Csapo
--------------------------------------------------
 /"\
 \ / CAMPANHA DA FITA ASCII - CONTRA MAIL HTML
  X  ASCII RIBBON CAMPAIGN - AGAINST HTML MAIL
 / \
--------------------------------------------------
http://www.completo.com.br/~jorge
===========================================
With a PC, I always felt limited
by the software available.
On Unix, I am limited only by my knowledge.
--Peter J. Schoenster