On Sun, 30 Mar 2003, Nainil Chheda - [http://services.eliteral.com] wrote:
I created an export called: /data/acct @linux_ALL(rw,sync,wdelay,root_squash,anonuid=65534,anongid=65534)
From what I read, by using root_squash. Root shouldn't be allowed to browse the directories and read the data under the mount. Unless it was somehow given explicit permission to.
When I mount that export from another machine, as root on that machine, I can browse all of the folders. The root accounts between machines have different passwords.
Any insight as to how I can stop a external root user gaining access to my NFS mount I would appreciate it.
Quoting straight from NFS-HOWTO:
... Now, if a user with UID 0 (i.e., root's user ID number) on the client attempts to access (read, write, delete) the file system, the server substitutes the UID of the server's 'nobody' account. Which means that the root user on the client can't access or change files that only root on the server can access or change. That's good, and you should probably use root_squash on all the file systems you export. "But the root user on the client can still use su to become any other user and access and change that users files!" say you. To which the answer is: Yes, and that's the way it is, and has to be with Unix and NFS. This has one important implication: All important binaries and files should be owned by root, and not bin or other non-root account, since the only account the clients root user cannot access is the servers root account. In the exports(5) man page there are several other squash options listed so that you can decide to mistrust whomever you (don't) like on the clients. ...
After root->nobody mapping, file permissions come into play, so if your still allow read access to nobody (or others/world), you will be able to browse and read/write files as nobody depending on local file permissions. For more you know where to go now.
HTH, Rajesh