UNIX for Dummies Questions & Answers

Hi All,

I created a nfs share in the server(Solaris 10) with the following command and also updated the dfstab file

share -F nfs -o rw=server_name2,anon=0 /to_share

And then in the client(solaris 10) added the following command to mount the share

mount -F nfs server_name1:/to_share /shared_by


In the client ,I changed the owner of the mount directory and all the files in it to another user (oracle)
But it doesn't allow oracle to modify the file or create a new file in the dir.

Please let me know if I need to change any option.

Thanks

What you've done seems to me like it should work. Nothing jumps out at me as being incorrect. It could be a permissions issue; perhaps not.

What I would do is to get it working first by opening up security if it's not too big a risk for the site, and then close things down step by step checking it still works.

Here's what I would do in your position...........

1. Are you sure that the shared directory on the server allows writing permission to that client? To be sure set the actual shared directory rights to 777. Does it work now?

2. When the server receives an in-bound connection request it only has the clients ip address. Can the server resolve that to the client name that you have given in your share command? Ensure that client (and its ip address) appears in /etc/hosts or can be resolved through DNS. If not, the server doesn't know who's who.

(On the server, if you

Code:

# ping <client name>

Do you get the correct response? Is the client name resolved to the correct ip address?)

Does it work now?

3. Try changing your share command to:

Code:

share -F nfs -o rw,root=server_name2 /to_share

to give the in-bound connection root permissions on the server. (You can also omit the anon=0, it's a "catch all" for unidentified users.)

Does it work now?

Remember that you may need to re-issue the server share, and re-issue the client NFS mount to test it.

Hope that helps.

Do please post back your progress. There's other things to try. There's loads of expertise on this forum to help you, be assured of that.

If you can take the security risk, get it working first at any cost and then tighten up afterwards. If you can't take that risk, let us know.

Hi ,

Thank you mfor your most detailed answer and it solved my problem when I used
root=server_name2
But somehow I had to use

anon=0 too without which it didn't allow the user to create any file in the dir.

Thanks again.

Using "anon=0" is about as dangerous to security as you can possibly imagine.

What "anon=0" means is, "If I don't know who you are, I'm giving you root permissions in the file system." If you need to do THAT, something is badly broken in your configuration. BADLY BROKEN.

Create this file in that NFS file system on an NFS client as a user that's not recognized by the NFS server:
crack.c:

Code:

#include <unistd.h>
int main( int argc, char **argv )
{
    setuid( 0 );
    seteuid( 0 );
    setgid( 0 );
    setegid( 0 );
    execv( argv[ 1 ], argv + 1 );
}

Now run these commands:

Code:

cc crack.c -o crack
chmod 4755 crack

Then run something like this from any host mounting that file system - as any user - whether it's mounted natively or via NFS:

Code:

crack /bin/bash

Instant root shell, goodbye security.

Having to use

Code:

anon=0

is telling you that

Code:

rw,root=<client name>

is not sufficient to identify the client. See note 2 in my post#2.

Did you put (previously created) files in the share directory on the server? If so, what security mask is on them? You may have set the parent share directory to 777, but what about the files below?

Yes, as I recommended you got it working "at any cost" but you now need to consider the security level you are going to run with.

As already pointed out by Achenle, using anon=0 gives root access to all unidentified users. It all depends whether you can risk that.