HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

5.10.2 Files Mounted in an NFS Environment
A Network File System (NFS) provides the following conveniences:
• Saves file space.
• Maintains consistent file usage.
• Provides a lean cooperative user environment.
NFS streamlines filesharing between server and client systems by controlling access
via the /etc/exports file. Entries in /etc/exports provide permission to mount
a file system existing on the server onto any client machine or specified list of machines.
When a file system is put into /etc/exports, the information is available to anyone
who can do an NFS mount. Thus, the NFS client user can access a server file system
without having logged in to the server system. See exports(4) for information on
controlling access to exported file systems and see Section 5.10.2.3 for security guidelines.
5.10.2.1 Server Vulnerability
Maintain server security by setting restrictive permissions on the /etc/exports file.
Root privileges are not maintained across NFS. Thus, having root privileges on a client
system does not provide you with special access to the server.
The server performs the same permission checking remotely for the client as it does
locally for its own users. The server side controls access by the client to server files by
comparing the user ID and group ID of the client, which it receives via the network,
with the user ID and group ID of the server file. Checking occurs within the kernel.
A user with privileges on an NFS client can exploit that privilege to obtain unlimited
access to an NFS server.
NOTE: Never export any file system to a node on which privilege is granted more
leniently than in your own node's policy.
5.10.2.2 Client Vulnerability
In earlier releases of NFS for workstations, the /dev inode had to reside on the client's
disk. NFS now allows the /dev inode containing the major and minor numbers of a
client-mounted device special file to exist on the server side. This opens the possibility
for someone to create a Trojan horse that overrides permissions set on the client's
mounted device special file, by accessing the device special file through the file and
inode number found on the server side.
Although lacking permission to make a device special file on the client side, a system
violator can create a device special file, such as /dev/kmem, using root permissions
on the server side. The new /dev file is created with the same major and minor number
as that of the target device on client side, but with the following permissions:
crw-rw-rw-
5.10 Controlling File Security on a Network 107