[19] in linux-net channel archive
Re: NFS mounting and security
daemon@ATHENA.MIT.EDU (Swen Thuemmler)
Mon Jan 16 04:55:20 1995
Date: Mon, 16 Jan 1995 09:52:52 +0100 (MET)
From: Swen Thuemmler <swen@uni-paderborn.de>
To: Linux Activists <linux-activists@niksula.hut.fi>
Cc: Linux Net <linux-net@vger.rutgers.edu>
In-Reply-To: <95Jan13.114516eet.56791-1@niksula.hut.fi>
X-Mn-Key: NET
On Thu, 12 Jan 1995, Johannes Stille wrote:
> And strict checking in the kernel does hardly result in any additional
> security:
>
> It _is_ AFAIK possible for any user on any machine to send forged NFS
> replies to us. But how big are the chances of a random answer being
> accepted for any of our requests?
>
> To really do damage, an attacker would have to receive our replies. To
> do this, he has to have root privileges or to be on a machine without
> user authentication. Then he can switch his network interface into
> promiscuous mode, intercept our NFS requests and send his forged
> replies. But then he is able to forge the source address of the replies
> as well, so the check in the Linux kernel does *not* *help* at all.
Another point: we are the client, how can an attacker harm us apart
from claiming being the server and giving bogus results? I think an
NFS server is a much likelier target for attacks (all those files full
of data to read and write...).
--Swen
