AI finds thousands of zero-day exploits... including in FreeBSD.

iSCSI allows you to share physical storage but only *one* client (initiator) can access a given storage volume (LUN) while NFS allows more than one client to access the same file so even if you use an iSCSI device for NFS storage you still have the same security issues with NFS. Use of a proper capability design would allow secure access to network files but using it is nowhere near as easy as Unix's simplistic design of permission mode bits and shared password/group mapping.
 
OpenFreeNet said:
If there is security hole in NFS + Kerberos, the security hole does not depend from where NFS store the data: it can be a local device or a iSCSI device.
Click to expand...
So a normal user can circumvent security-related features of iSCSI by sharing files from it via nfs? I think that contradicts the UNIX permission hierarchy, like a child cant have more permissions than its parent.
 
MG said:
So a normal user can circumvent security-related features of iSCSI by sharing files from it via nfs? I think that contradicts the UNIX permission hierarchy.
Click to expand...

Code: 
iSCSI ---> NFS service ---> NFS client

If iSCSI has no security holes, only the NFS service can see the data on the iSCSI device. But, if NFS has security holes, a non-authorized NFS client can receive data from the NFS service. iSCSI has no fault: it sends the data only to the NFS service, as configured.
 
OpenFreeNet said:
Code: 
iSCSI ---> NFS service ---> NFS client

If iSCSI has no security holes, only the NFS service can see the data on the iSCSI device. But, if NFS has security holes, a non-authorized NFS client can receive data from the NFS service. iSCSI has no fault: it sends the data only to the NFS service, as configured.
Click to expand...
Only if the user who configured nfs has more permissions than the user who mounted the iSCSI device. That's not on top of but 2 independent services.
 
MG said:
Only if the user who configured nfs has more permissions than the user who mounted the iSCSI device.
Click to expand...
No, but at this point I give up. Maybe other users with more knowledge of iSCSI and/or NFS can explain better than me, or maybe I didn't understood some detail of this discussion. BTW, I never used iSCSI.
 
bakul said:
Device permissions have nothing to do with filesystem level permissions.
Click to expand...
A user's permissions are device and file permissions, once set by root.
If a user has no access to a file in a iSCSI volume, neither has a nfs-server initiated by that user, sharing the same file (assuming it's somehow visible or manually referenced to without checking its existance). Permission denied with no explanation.
 
OpenFreeNet said:
I never used network file systems, apart some sshfs connection, and minimal Samba setup, but they intrigue me a lot. CephFS, Garage, Seaweed, etc.. Or distribuited filesystems like IPFS and hyperdrive.
Click to expand...

If you dislike the performance of NFS then you are in for a surprise with Ceph.
 
You must log in or register to reply here.
Back
Top