0

After some research, it seems that the best way to share files between my Debian Xen host and the virtual machines on it is to use NFS.

How can I secure NFS so that only the specified VM can access it? Using IP addresses and iptables would work, however it doesn't really seem like the most secure method. Could I block NFS on my bond0 interface and allow it between the host and virtual machines using the xenbr0 interface? Here is my /etc/network/interfaces configuration:

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# network interfaces
auto eth0
iface eth0 inet manual
   bondmaster bond0

auto eth1
iface eth1 inet manual
   bondmaster bond0

#lacp bonded interface
auto bond0
iface bond0 inet manual
   bond-mode 4
   bond-miimon 100
   bond-lacp-rate 1
   bond-slaves eth0 eth1

#xen bridge
auto xenbr0
iface xenbr0 inet static
   bridge_ports bond0
   address 10.0.0.12
   gateway 10.0.0.1
   netmask 255.255.255.0
1

Decide what you want to do:

  • application-independent and more "general" network security done by iptables on the NFS server
  • application-specific security done by nfsd on the NFS server
  • or both.

In NFS, you share a directory read-only to a specific client as follows:

echo "/mynfs clt.xmpl.com(sync)" >> /etc/exports.d/my-ro.exports
exportfs -r
  • Thanks. I think I'll go ahead and set up Kerberos for NFSv4. Relying on IP addresses and hostnames for security just isn't secure enough since a compromised VM could change its address easily. – Torvero May 12 '15 at 8:34
1

First I would use sshfs.

Second up to NFSv3 on Linux NFS is insecure. You can either build a private NFS network or use secure NFSv4.

  • Any time I've used sshfs it's been pretty slow. I'm considering setting up a Kerberos KDC and using NFSv4 for this as it seems the best option for speed and security. – Torvero May 12 '15 at 8:32
  • @Nysepho I don't know if NFSv4 will be fast enough for your needs. iSCSI could be faster. There you have to activate CHAP to make the connection initiation secure. Do you need encrypted data on the line, too? – Nils May 13 '15 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.