"The goal of this howto is building a NFS server that works on an SSH tunnel. This way all traffic between your hosts and the file server is encrypted and thus more secure. Normally you should enter a password every time you try to establish a SSH connection but since we could be mounting at bootup we will use ssh-keygen to create a keypair so we can login without entering a password. We will, however, limit that login session to executing just 1 command."
Post a Comment
Member since:
2006-08-15
Member since:
2006-02-13
This howto could really be better :
1. It could have set fixed port number on the server. This way even after a restart, there should have no issue.
2. instead of SSH tunneling ( which need a user auth ), it could have use stunnel to do a SSL tunneling between the nfs client and the nfs server.
http://www.stunnel.org/
Member since:
2005-11-17
Member since:
2005-07-18
This seems like good information, although SSH is being pressed into service as a VPN.
I already use NFS over an OpenVPN (http://openvpn.net/) connection. I believe it uses the same OpenSSL library as OpenSSH, so presumably the security should be similar. But OpenVPN gives me a more general VPN connection which is useful for other applications also.
Member since:
2006-09-27
Should have done that right from the start :x
Member since:
2006-06-14
Member since:
2005-12-19
Member since:2005-11-16
There are stacks of ways to do the same thing here. The article is just a howto on one solution.
I have always tried to use NFS instead of SMB/CIFS and the others seeing as I am in a pure $nix network. But I would say the final straw was the strange problem I had where NFS would not allow the viewing of files and folders on server that were on a mounted filesystem off the exported tree. Eg. export /home/user. /home/user/other is a mounted fs (/dev/hdg1). From the client I can't see files in /home/user/other. Bizzar. SMB/CIFS can. I use CIFS everywhere now because it is easy to set up (easy to configure, PITA to install). All other network file systems are overkill to use in a small network. If I need secure remote access I use either hamachi or openvpn.
Member since:
2005-10-26
I would recommend to use http://www.fs.net/ on WAN.
Member since:
2006-02-16
Probably a better solution is to set the shared user account shell to /bin/false, then construct the tunnel with the ssh -N option (which will put the ssh session in tunnel only mode, thereby not calling to shell, which will, as desired, fail with /bin/false as the shell).
This way the shared account is more controlled beyond just ssh sessions.
Bert
