Path: utzoo!attcan!uunet!munnari!vuwcomp!duncan
From: duncan@comp.vuw.ac.nz (Duncan McEwan)
Newsgroups: comp.unix.wizards
Subject: Re: NFS security
Keywords: NFS, mknod
Message-ID: <14186@comp.vuw.ac.nz>
Date: 6 Sep 88 23:03:35 GMT
References: <126@leibniz.UUCP> <670028@hpclscu.HP.COM> <1394@basser.oz> <1202@luth.luth.se> <66897@sun.uucp>
Reply-To: duncan@comp.vuw.ac.nz (Duncan McEwan)
Organization: Comp Sci, Victoria Univ, Wellington, New Zealand
Lines: 39

In article <66897@sun.uucp> guy@gorodish.Sun.COM (Guy Harris) writes:
>> On all SunOS that I have access to (3.2, 3.5, 4.0) I got this when I try.
>> 
>> mknod: must be super-user
>> 
>> So it is a NFS problem.
>
>The only line of reasoning that I can see ... is "Sun invented NFS, so if it
>happens on all versions of SunOS it must be an NFS problem".    However, this
>is one of the silliest lines of reasoning I have ever had the misfortune to
>encounter ... Any other line of reasoning, however, is likely to be equally
>silly

The way I interpreted the comment that Guy is responding to was, "on
all versions of SunOS without NFS, mknod does not have a problem, and
since (as desribed in a previous article) there is a problem with
mknod on systems with NFS, it is an NFS problem".  Given this
interpretation the reasoning doesn't seem so silly.

For those that missed the posting describing the actual problem, it
showed how root on a workstation with NFS is able to gain read/write
access to the memory (and presumably using the same mechanism, the
disk partitions?) of an NFS server.  This seems to be more serious
than the well known "root on a workstation can easily access any other
(non root) users files on a server" problem.

One partial solution to both of these problem for machines that can be
accessed by people you don't trust, is to make it harder to become root
on those machines.  I think SunOS 4.0 can be configured to require the
superuser password before coming up in single user mode.  Of course,
there may be many other ways of becomming root on the workstation that
this doesn't protect against, but at least it blocks off one of the
easiest.  Do any other workstation vendors provide this protection?

My only information regarding this feature in SunOS 4.0 is a brief
mention in the 4.0 release notes, so I may have mis-interpreted it.
No doubt someone will correct me if I have.

Duncan