Subject: [nfsv4] FedFS security considerations

From: James Lentini <[email-masked]>
Date: Wed, 18 Mar 2009 11:45:41 -0400 (EDT)

I'm frequently asked about the security assumptions made in FedFS. 
I'll describe FedFS's approach to this topic with the goal of 
generating email discussion on this topic before the working group 
meeting next week.

FedFS does not provide any new security mechanisms. For NFS client to 
NFS server traffic, FedFS recommends the use of the standard NFSv4[.1] 
security mechansims available with RPCSEC_GSS. For NFS server to 
namespace database (NSDB) LDAP queries, FedFS recommends use of TLS to 
secure the network communication.

In a FedFS system, an attacker has two targets: the NFS servers and 
the NSDBs. If the attacker subverts an NFS server, the results are the 
same as if FedFS were not enabled. If the attacker compromises an 
NSDB, the attacker will be able poison the fileserver's referral 
information.  Therefore an NSDB should be as secure as the fileservers 
which query it.

A FedFS-enabled NFS server nevers acts as a proxy for an NFS client. 
As a result, there are no server to server protocols to be concerned 
about.

Section 8 of the NSDB Protocol draft covers this in detail.

-james