Solved

Solaris 10: Bind NFS server to specific interface

Posted on 2006-11-09
9
2,670 Views
Last Modified: 2013-12-21
Does anyone know how to configure the Solaris 10 NFS server to listen on a specific interface? It listens on all interfaces by default and I can't find any options in the man pages to change this.

My server is dual homed, with one interface configured with an internet facing IP address, and the other on a local 10.x.x.x private network. Unfortunately NFS is listening on both interfaces, and I *really* only want it to listen on the local interface - there will not be any legitimate connections from the internet interface, which makes this a security risk.
The NFS man pages suggest this is not possible ... has anyone dealt with this before, or should I investigate using tcp wrappers on the NFS daemons?
0
Comment
Question by:shealey
  • 4
  • 4
9 Comments
 
LVL 10

Accepted Solution

by:
Nukfror earned 250 total points
ID: 17924932
You could also use IPFilter to make this happen.
0
 
LVL 6

Expert Comment

by:durindil
ID: 17950760
You can specify "access=" options for your NFS exports, and restrict it to hosts, subnets, or nis netgroups
0
 
LVL 1

Author Comment

by:shealey
ID: 17950995
Yes I know, the share access controls are fairly clearly described in the MAN pages.

Problem is, access controls on the shares doesn't stop people from breaking into the port(s) on which the daemons are listening on the internet-facing interface.

I also don't want to have to maintain firewall rules either just to solve a security issue with one service. I think I'm going to have to go with tcpwrappers.
0
Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

 
LVL 10

Expert Comment

by:Nukfror
ID: 17955316
Run bind in a sparse root zone which is using the specific interface (and an IP on the same network as that interface) you want.
0
 
LVL 10

Expert Comment

by:Nukfror
ID: 17955321
Sorry !!! Never mind ... don't know how I got bind mixed into a NFS question .... LOL
0
 
LVL 1

Author Comment

by:shealey
ID: 17955506
Funny you should mention it though, because I am in the process of researching how to create a Solaris zone.

I realised the other day that I can run services in 'zones' or 'containers' (which are brand new in Solaris 10), so what I probably need to do to fulfill my requirement is create a new zone which contains only the local network interface and the relevent file system - then bind NFS (and probably MySQL as well) to the new zone (which I think is done through the new svcadm interface).
0
 
LVL 1

Author Comment

by:shealey
ID: 17955523
Question is, is it a good idea to use zones on a uniprocessor machine...?
0
 
LVL 10

Expert Comment

by:Nukfror
ID: 17962468
Two answer your second question - sure, zones will work just dandy on a single process machine.

*BUT* you can't run NFS in a zone today.  NFS must be run in the Global zone :(  The NFS server requires some process rights that zones aren't currently allowed to have.  I believe there is a RFE out to address this.
0
 
LVL 1

Author Comment

by:shealey
ID: 18323134
After much consideration, I'm going to firewall the WAN facing interface. Its the only way to be sure.

I will try 'Sunscreen lite' which can be downloaded from sun.com for free, and it that is a nightmare to configure I'll revert to one of the tried and tested OSS firewalls such as pf or iptables as mentioned above.

Thanks for comments guys.

Sean.
0

Featured Post

Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Linux performance issues with 100% swap usage, etc 15 93
FTP on FreeBSD server 2 126
dot directory in FreeBSD??? 4 78
Bash Script to Analyze Oracle Schemas 11 102
Hello fellow BSD lovers, I've created a patch process for patching openjdk6 for BSD (FreeBSD specifically), although I tried to keep all BSD versions in mind when creating my patch. Welcome to OpenJDK6 on BSD First let me start with a little …
Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:

816 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now