Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I understand how it works, NFS security relies in the fact that the clients can be trusted.

I'm worried about some users accessing files from others. Yes, root_squash option avoid root user on clients to access the files, but if someone has root privileges on any client, he can su into any user and then access the files they want.

I'm currently exporting the files to all the local network. I'm thinking on export only to a netgroup of trusted clients --but it will be probably a pain to maintain, and it only obscures the problem a bit, the problem still persists if some trusted client gains root access.

share|improve this question
up vote 6 down vote accepted

NFS is a security hole with file access -- there is nothing you can really do to mitigate that. The best thing you can do is only allow exports to trusted clients as you described, and optionally use firewall rules to prevent other people from sneaking through and talking to your NFS server (even though they theoretically wouldn't be able to do anything you may as well make sure they're locked out).

If you use NFSv4 exclusively you can Kerberize your NFS environment, which offers some better security options in terms of authenticating clients, but the work of maintaining the Kerberos environment is probably equal to (or greater than) maintaining netgroup export lists -- If you're using Kerberos anyway though it may be a better solution for you.

share|improve this answer
Thanks, that's not pleasant to hear, but I guess that's the terrifying truth. – Jorge Suárez de Lis Nov 2 '12 at 10:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.