The release of NFSv4 brought a revolution to NFS security by mandating the implementation of RPCSEC_GSS and the Kerberos version 5 GSS-API mechanism. However, RPCSEC_GSS and the Kerberos mechanism are also available for all versions of NFS. In FIPS mode, only FIPS-approved algorithms can be used.
With the RPCSEC_GSS Kerberos mechanism, the server no longer depends on the client to correctly represent which user is accessing the file, as is the case with AUTH_SYS. Instead, it uses cryptography to authenticate users to the server, preventing a malicious client from impersonating a user without having that user's kerberos credentials.
It is assumed that a Kerberos ticket-granting server (KDC) is installed and configured correctly, prior to configuring an NFSv4 server. Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC. For more information on Kerberos see Red Hat's Identity Management Guide.
To set up RPCSEC_GSS, use the following procedure:
Procedure 9.4. Set up RPCSEC_GSS
Add the corresponding keys to keytabs for the client and server.
On the server side, add
sec=krb5,krb5i,krb5p to the export. To continue allowing AUTH_SYS, add
On the client side, add
sec=krb5p depending on the set up) to the mount options.
188.8.131.52. NFS security with NFSv4
NFSv4 includes ACL support based on the Microsoft Windows NT model, not the POSIX model, because of the former's features and wide deployment.
Another important security feature of NFSv4 is the removal of the use of the
MOUNT protocol for mounting file systems. This protocol presented possible security holes because of the way that it processed file handles.