NetNews Usenet Archive 1992 #19/NN_1992_19.iso/spool/comp/protocol/tcpip/ibmpc/5030

Internet Message Format | 1992-09-02 | 3.5 KB

Xref: sparky comp.protocols.tcp-ip.ibmpc:5030 comp.protocols.nfs:2211
Path: sparky!uunet!dtix!darwin.sura.net!jvnc.net!netnews.upenn.edu!catone
From: [e-mail] (Tony Catone)
Newsgroups: comp.protocols.tcp-ip.ibmpc,comp.protocols.nfs
Subject: Re: How to mount PC file systems via tcp/ip?
Message-ID: <[e-mail]>
Date: 2 Sep 92 22:18:38 GMT
References: <[e-mail]> <[e-mail]>
    <[e-mail]>
Sender: [e-mail]
Followup-To: comp.protocols.tcp-ip.ibmpc
Organization: University of Pennsylvania
Lines: 59
Nntp-Posting-Host: sovereign.wharton.upenn.edu
In-reply-to: [e-mail]'s message of 27 Aug 92 02:02:43 GMT

In article <[e-mail]> [e-mail] (Ulf Andrick [Biologie]) writes:

   In article <[e-mail]>, [e-mail]  (James B.
   VanBokkelen) writes:
   > In article <[e-mail]>
   [e-mail] (Ulf Andrick) writes:
   >
   >     I read somewhere that one could use idmnt by FTP to mount directories
   >     of another PC running SOSS (Stan's Own Server) and wanted to try it.
   >
   >     But idmnt attempts to transmit user and password and seems to expect
   >     some appropriate response, which SOSS apparently does not deliver.
   >     ....
   >
   > In an effort not do do "the Emperor's New Clothes" with "NFS Security",
   > the IDMNT.EXE we distribute insists on authentication via a PCNFSD server,
   > and doesn't allow the user to specify the UID/GID as integers.  Thus, it
   > can't talk to SOSS.  However, you can get from our Tech Support people
   > a MNT.EXE which lets you specify UID/GID and mount SOSS (and other things
   > that don't have PCNFSDs available).

Maybe things have changed, but with the Interdrive version 1.1 pl 2 I use,
one can specify sec_arg=nobody to mount the directory with "anonymous" privs.
Since SOSS has no concept of uids or gids, this lets you mount any exported
SOSS directory.  Has this very useful feature been removed in later versions
of Interdrive?

   I thought that asking for a password was the proper thing to do for idmnt
   and attributed the problem mainly to SOSS.

Why did you think that?  NFS doesn't use passwords, just uids and
gids.  PCNFSD is a hack to try and give the verisimilitude of
security.

   I hoped that it could be set up to accept a request for
   `authentication'.

You have the source code: are you volunteering to do the work?

   I don't really like the idea that the server is accessible to everybody.
   But one security measure might be to give the directories to mount some
   incomprehensible names. By joining the hard drives to a virtual disc, it
   might even be possible to make the whole filesystem of the server
   accessible from such a directory, which would reside on the virtual disc.
   Is there any possibility to fool this, so that one can mount the directory
   without knowing its name?

Now you are just being silly.  The server is not accessible to
everyone, just the machines you specify in export.us.  And obfuscation
through incomprehensible names won't work as showmount -e will tell
you a machines mount points and to whom they are exported, although
SOSS usually tells you the drives are exported to everyone even when
they are not.  This last "feature" actually gives you more security
than a unix host, at least as far as IP spoofing goes.  Use SOSS' -r
switch if you want to export read only.


- Tony
  [e-mail]