NFS mount of "/nfs" totally bypasses all security? WHOA

My Cloud OS 3 Personal & Network Attached Storage My Cloud
1

Seems like I can mount “/nfs” from the MyCloud onto one of my Linux boxes and have full control over all files including delete?

[root@dc ~]# showmount -e 192.168.0.44
Export list for 192.168.0.44:
/nfs *
[root@dc ~]# mount -o soft 192.168.0.44:/nfs /mnt
[root@dc ~]# cd /mnt
[root@dc mnt]# ls
Public SmartWare TimeMachineBackup Tunes

[root@dc mnt]# du -sk Tunes
9982572 Tunes

[root@dc mnt]# rm -rf Tunes
rm: cannot remove `Tunes’: Device or resource busy
[root@dc mnt]# ls
Public SmartWare TimeMachineBackup Tunes
[root@dc mnt]# ls Tunes
[root@dc mnt]#

2

FYI same result mounting the NFS share under windows, full delete rights

screensnap.png
screensnap.png960×540 34.5 KB

3

Well, yeah, that’s how NFS works.   NFS doesn’t authenticate, so how would it know who you are?

4

I guess I was expecting “root_squash” on the export.

But, hey this looks to be a much CLEANER/EASIER way to use the device for my purposes…

Just map the NFS drive to any host I want and have at it… No WD software required.

5

Maybe a little guide to that on W7?

6

What do you need NFS tutorial for Win7?

Just enabled it and mount via “map network drive…”

MIght need Enterprise or Ultimate? I have Ultimate

Control Panel > Programs and Features > Turn Windows features on or off (upper left corner) > Check ‘Services for NFS’ in the listing > Ok each dialog

OR

http://sagehacks.wordpress.com/2009/01/21/howto-mount-nfs-shares-under-windows-7/

7

JRman wrote:

I guess I was expecting “root_squash” on the export.

Squash is default on NFS, and the WD isn’t turning it off.   In fact, the Cloud maps everything to anoynymous via the all_squash flag.

CloudNAS:~# cat /etc/exports
# Use nobody user (uid 65534) for nfs guest. This is restricted from private
# shares by ACLs.
#
/nfs *(rw,all_squash,sync,no_subtree_check,insecure,crossmnt,anonuid=65534,anongid=1000)

 I think what you’re confusing is how the permissions are used when combined with the trustees.conf policies.

But by the way – what you can do with NFS is based on the file permissions (as defined on the cloud itself), modified by the TRUSTEES configuration masks, etc.

Samba treats permissions very differently.   So if you copy files over with Samba, for example, they’re going to be the permission of the user that is used in the Samba logon, in which case the AnonUID / AnonGID will apply via NFS, and you probably won’t have the same effect.

8

Ok thats why I could not achive, Only works with Windows 7 Professional or better. Not available in home premium.

9

JRman, may I have a word of your wisdow regarding how to setup NFS. My Linux knowledge is scarce and frankly WD information available is almost inexistent .

I want an Openelec HTPC to read NFS shares from a WD My Cloud. I can “Add network source: NFS” on the htpc and i am able to see the /nfs share. But that is all. My movies and video files do not appear after i refresh the source.

I don’t know if it has to do with setting user nobody (uid 65534). Any help will be greatly appreciated.