0

We bought a new H-NAS Server and running fine. We created 500GB of space for our subversion repositories and the nfs share has been created.

When I create a new directory the owner and group shows as nobody nogroup as below.

drwxr-xr-x 2 nobody nogroup 2048 2013-07-03 19:09 test

I created a svn repository on nfs share, when I tried to change the user & group its says Operation not permitted. Is that related to nfs share mounting.

I executed the command mount 10.9.17.59:/subversion /subversion to mount the nfs share. it got mounted properly.

when I executed the chown -R www-data:www-data REPO-NAME is says Operation not permitted.

Can you please tell me, what could be the issues. Please help me to solve this issue.

Improve this question
4
  • Which version of NFS are you using? The semantics for permissions are different between 3 and 4.
    – Gazzonyx
    Jul 3, 2013 at 14:04
  • @FredClausen Please be aware of the security dangers involved in the "no_root_squash" option: github.com/bonsaiviking/NfSpy#vulnerability-exploited
    – bonsaiviking
    Jul 3, 2013 at 14:36
  • @bonsaiviking Yes indeed. Good point, I will edit my comment to make that a last resort option.
    – Friedrich 'Fred' Clausen
    Jul 3, 2013 at 14:40
  • 1
    Updated comment (old one deleted): I would first make sure the NFS server and clients use a common user source to prevent UID/GID remapping. As a last resort you can look at "no_root_squash" but that is insecure as highlighted by bonsaiviking above.
    – Friedrich 'Fred' Clausen
    Jul 3, 2013 at 14:43

1 Answer 1

Reset to default
1

NFS (before version 4) simply trusts the UID and GID that a client declares for any particular action (creating a file, reading a file, etc.). This has the obvious downside that a malicious client can lie about the UID and GID. If it lies and says "I am UID 0," then the server will assume it has access to all files on the export. This is Bad™.

To combat the issue, there is a setting: root_squash. This setting means, "If you say you are UID 0, I will assume you meant UID nobody." Clients can still lie, but they can't be root. This is good, but it comes with some downsides:

  • You can't chown files through NFS (since only root can do that)
  • You can't create root-owned files or directories.

Essentially, your best and only option to create root-owned files and directories in an NFS share is to log into the server and create them locally. For all other operations, use non-root accounts.

You may be tempted to turn off this protection with no_root_squash, but that would be Bad™. To see how easy it is for an attacker to steal or delete all your files, you can use NFSpy. At least read the README to get an idea of the security implications of various options.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .