Problem

How to restrict NFS share access to a particular server in HP-UX?

I had an NFS shared directory (/testlogs) on my HP-UX server DBSERVER and it was exported to a particular host DBCLIENT1. directory /testlogs was mounted on the DBCLIENT1 and it was working fine. One day during some security testing it was found that NFS shared directory (/testlog) can be mounted on any host (which can access the DBSERVER) which was a very critical vulnerability. Due to this vulnerability, an attacker may be able to leverage this to read (and possibly write) files on a remote host i.e. DBSERVER.

NFS sharing configuration for /testlogs was as shown below in /etc/dfs/dfstab file:

 
# vi /etc/dfs/dfstab
.
.
"/etc/dfs/dfstab" [Read only] 9 lines, 394 characters
#       place share(1M) commands here for automatic execution
#       on entering init state 3.
#
#       share [-F fstype] [ -o options] [-d ""] 
#       .e.g,
#       share  -F nfs  -o rw=engineering  -d "home dirs"  /home
/usr/sbin/share -F nfs -o rw=DBCLIENT1 /testlogs
.
.

Reason

Share the pathname read-mostly if the sec= option is not provided. Read-mostly means read-write to those clients specified and read-only for all other systems. If a sec= option is provided, the pathname is shared read/write only to the listed clients. No other systems can access pathname.

Solution

Use a combination of the ‘sec‘ keyword and ‘ro‘ or ‘rw‘ access for specific hosts in the /etc/dfs/dfstab. I have changed the /etc/dfs/dfstab file as shown below to share the /testlogs explicitly to DBCLIENT1.

 
# vi /etc/dfs/dfstab
.
.
"/etc/dfs/dfstab" [Read only] 9 lines, 394 characters
#       place share(1M) commands here for automatic execution
#       on entering init state 3.
#
#       share [-F fstype] [ -o options] [-d ""] 
#       .e.g,
#       share  -F nfs  -o rw=engineering  -d "home dirs"  /home
/usr/sbin/share -F nfs -o sec=sys,ro=DBCLIENT1 /testlogs
.
.

After making the changes in the /etc/dfs/dfstab file run the exportfs -a command to come to the changes in effect.

 
# exportfs -a

Now mount the /testlogs on DBCLIENT1, it will be successfully mounted and will be accessible.

[root@DBCLIENT1 ~]# mount DBSERVER:/testlogs /home/testlogs

[root@DBCLIENT1 ~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
DBSERVER:/testlogs     5.0G  750M  4.3G  15% /home/testlogs
[root@DBCLIENT1 ~]#

Now if anyone tries to mount the /testlogs on any other server like DBCLIENT2 then he will find the access denied message as shown below:

[root@DBCLIENT2 ~]# mount DBSERVER:/testlogs /home/testlogs
mount.nfs: access denied by server while mounting DBSERVER:/testlogs
[root@DBCLIENT2 ~]#

Reference:
https://community.hpe.com/t5/Networking/How-to-restrict-NFS-share-access-to-particular-server/td-p/6392411

Last updated: Nov 27, 2018

HP-UX: How to restrict NFS share access to a particular server

Problem

Reason

Solution

Related Posts

Leave a Reply Cancel Reply