Encrypt NFSv4 with TLS Encryption Using Stunnel (linuxjournal.com) 83
The systems and database administrator for a Fortune 500 company notes that while NFS is "decades old and predating Linux...the most obvious feature missing from NFSv4 is native, standalone encryption." emil (Slashdot reader #695) summarizes this article from Linux Journal:
NFS is the most popular remote file system in the Linux, UNIX, and greater POSIX community. The NFS protocol pushes file traffic over cleartext connections in the default configuration, which is poison to sensitive information.
TLS can wrap this traffic, finally bringing wire security to files vulnerable to compromise in transit. Before using a cloud provider's toolset, review NFS usage and encrypt where necessary.
The article's author complains that Google Cloud "makes no mention of data security in its documented procedures," though "the performance penalty for tunneling NFS over stunnel is surprisingly small...."
"While the crusade against telnet may have been largely won, Linux and the greater UNIX community still have areas of willful blindness. NFS should have been secured long ago, and it is objectionable that a workaround with stunnel is even necessary."
TLS can wrap this traffic, finally bringing wire security to files vulnerable to compromise in transit. Before using a cloud provider's toolset, review NFS usage and encrypt where necessary.
The article's author complains that Google Cloud "makes no mention of data security in its documented procedures," though "the performance penalty for tunneling NFS over stunnel is surprisingly small...."
"While the crusade against telnet may have been largely won, Linux and the greater UNIX community still have areas of willful blindness. NFS should have been secured long ago, and it is objectionable that a workaround with stunnel is even necessary."
Use the right options (Score:5, Insightful)
Re: (Score:1)
They said standalone. Keberos isn't lightweight. There is quite a bit of administrative overhead that isn't woth the squeeze for small groups.
Re: (Score:2)
Re: (Score:2)
True the tools used to onboard *NIX (except solaris) are pretty shit (I'm looking at you SSSD).
For AD when generating your keytabs you need to salt the keys with the internal UPN (ie: samaccountname@ad.domain, minus the dollarsign for computer accounts) for every principal assigned to the account, but once you know that is is trivial to script the onboarding.
Then you just need to ensure your service accounts that use NFS
IPsec (Score:4, Insightful)
You could also do NFS over IPsec.
NFSv3 could be fine as well.
Often no need for complicated designs like NFSv4 and Kerberos.
Re: IPsec (Score:2)
Comment removed (Score:5, Insightful)
Re: (Score:3, Insightful)
actually, NFS has encryption option, and the article tries to justify this extraneous stunnel solution by stating "waaah, it's too hard to do the built in..." which is bullshit
You can do NFS securely and without stunnel. end of story.
Re: Misses the point of NFS (Score:2)
Re: Misses the point of NFS (Score:2)
It's not really a work around (Score:4, Insightful)
We find a lot of weak encryption in weird places (Score:2)
> It also makes maintainence easier. Each application protocol having its own encryption leads to a lot of wheel reinventing and unnecessary man hours maintaining software.
I do vulnerability scanning and weak encryption issues are very common. Weak protocols, weak certs, etc. Often these are on devices or services that people don't think about very often. Using an ipsec or similar VPN tunnel between sites means EVERYTHING going over the wire is encrypted properly, by maintaining just one configuration. Y
Re: (Score:2)
it's a Unix philosophy: lots of smaller tools working well together instead of one big tool that tries to do everything and just turns into a mess.
Now, now, we’re only a few comments in and already someone’s complaining about systemd...
WOW! An non political tech article on /.!? (Score:1)
I'm in shock!
Re: (Score:1)
Slashdot has had political articles for nearly 2 decades. From example, [url=https://slashdot.org/story/98/12/16/1930206/us-and-uk-unilaterally-attack-iraq]here[/url] is one from 1998 that was heavily political. Cry more, snowflake.
Re: (Score:1)
Slashdot has had political articles for nearly 2 decades. From example, here [slashdot.org] is one from 1998 that was heavily political. Cry more, snowflake.
Re: (Score:1)
Which was what? That whining about political articles is silly since they've been posted to Slashdot since the very beginning of the site existing? If so, then yes, I did prove the snowflake's "point."
Re: (Score:1)
Awww, do I need to call the waaahmbulance for you?
Re: (Score:1)
From the article:
The sec=krb5p option will encrypt NFSv4 traffic in a Kerberos realm, but requiring this infrastructure is inappropriate in hosted environments and is generally far from helpful. Basic access to symmetric cryptography does not and should not mandate such enormous baggage.
What you quoted was commentary added by the submitter and was not from the article.
Re: What's really objectionable––& (Score:2)
Re: (Score:2)
Linux has documentation? I've found most of it horribly outdated.
Re: Why bother, work on sshfs (Score:1)
Newer =/= better. Sshfs is painfully slow compared to NFS.
sshfs rocks! But... (Score:2)
I love sshfs. It is incredibly easy and convenient and works in places where nfs would be really hard to implement. It allows me to mount any file system on the ssh server, including file systems that are NFS network mounted themselves.
However, I have found that sshfs is not very fast or stable. The sshfs mounted file systems will sometimes hang, even when my ssh terminal sessions remain up.
Maybe I should contribute to development.
Use GSSAPI (Score:3)
NFSv4 _does_ have native encryption, but it requires the use of GSSAPI (kerberos).
Re: (Score:3, Informative)
Yes and the article addresses that:
The sec=krb5p option will encrypt NFSv4 traffic in a Kerberos realm, but requiring this infrastructure is inappropriate in hosted environments and is generally far from helpful. Basic access to symmetric cryptography does not and should not mandate such enormous baggage.
Re: (Score:2, Informative)
"addressing" the issue by saying "wahhh it's way too hard", man up you pansies, kerberos isn't that hard
Re: (Score:2)
NFS was never meant to be used across WAN links.
Re: (Score:2)
WAN links and networking have evolved much over the lifespan of NFS. It can be done over WAN now with no problem.
Re: (Score:2)
People that have never done such things shouldn't comment using something they read as only reference. We do NFS over vpn on public internet across the country without issue. With today's gigabit plus links and high performance encryption hardware in firewalls there is no problem
Re: (Score:2)
Written by a millennial that doesn't know about IPSec
Re: (Score:1)
Man take a chill pill. He was just discussing that telnet has the ability to do encryption that's it. The article was poking fun at telnet. Besides telnet has some great terminal support still.
Re: (Score:2)
For a while when sshd was having numerous buffer overflows telnet made more sense :)
Re: If you're that worried about your LAN... (Score:2)
Re: SMBv3 (Score:2)
Re: the price of free (Score:2)
Stunnel? (Score:2)
Why noto plain SSH TCP forwarding?
Re: Stunnel? (Score:2)
Re: Not using Kerberos and ldap (Score:2)
Link speed and VPNs (Score:2)
This is a bit on the goofy side for /. Who didn't know NFS is insecure? Neither is CIFS/Samba, they're both insecure and from my perspective these are the two most used network file system protocols used in Linux.
And since NFS is been insecure since...forever. I've never used this thing not-over-a-VPN or only on LANs. Traditionally, NFS was not really used across WANs due to poor linkspeed across such WANs, and I seem to recall NFS being horribly bad on slow links. So no one really cared about securing
It is unreliable - it is locking up (Score:2)
"there is no reasonable solution for this kind of bug. There will always be a danger of deadlocks when using openvpn."
openvpn should behave the same as stunnel - a userspace program handling the data
Still super-useful at home! (Score:1)