Abstract
The NFS protocol provides transparent remote access to shared file systems across networks. It is very popular particularly in Unix networks where it is probably the most common distributed file system technology. NFS however is rarely used outside closed protected net-works, because its security is notoriously weak. In 1998 Sun Microsystems released what is considered the first attempt at providing comprehensive security to NFS: a security flavour called RPCSEC_GSS based on Kerberos V5 and the GSS-API. The main benefit of this version over previous versions is that for the first time each NFS file access call could be protected. This paper outlines our efforts to secure NFS producing a security solution with even greater functionality. The major new functionality is that users may optionally use an access control system based on role based access control (RBAC). RBAC allows users to log in, be provided with a role, and use this to transparently access their remote files through secure NFS. There are also other advantages provided, for example security for the mount protocol and the option of public-key technology for authentication and key distribution. NFS has been secured with SESAME V4 and the practicality and performance of this mechanism has been demonstrated by modifying the Linux kernel and NFS utilities.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
P. Ashley and M. Vandenwauver. Practical Intranet Security: An Overview of the State of the Art and Available Technologies. Kluwer Academic Publishers, 1999.
B. Broom and G. Gaskell. On the Recent Attacks Against WWW Systems. In Proceedings of the 2nd Joint Conference of AUUG and Asia Pacific World Wide Web, pages 28–36, September 1996.
B. Callaghan, B. Pawlowski, and P. Staubach. NFS Version 3 Protocol Specification, 1995. RFC1813.
W. Diffie and M. Hellman. New Directions in Cryptography. IEEE Transactions on Information Theory, 22(6):644–654, 1976.
ECMA 219. ECMA-219 Security in Open Systems-Authentication and Privilege Attribute Security Application with Related Key Distribution Functionality, 2nd Edition, March 1996. European Computer Manufacturers Association.
M. Eisler. NFS Version 2 and Version 3 Security Issues and the NFS Protocol’s Use of RPCSEC_GSS and Kerberos V5, April 1998. Internet Draft.
M. Eisler, A. Chiu, and L. Ling. RPCSEC-GSS Protocol Specification, September 1997. RFC2203.
M. Eisler, R. Schemers, and R. Srinivasan. Security Mechanism Independence in ONC RPC. In Proceedings of the 6th USENIX Security Symposium, San Jose, CA., July 1996.
D.F. Ferraiolo and R. Kuhn. Role-Based Access Control. In Proceedings of the 15th NIST-NSA National Computer Security Conference, Baltimore, MD., October 1992.
B. Hilchenbach. Observations on the Real-World Implementation of Role-Based Access Control. In 20th National Information Systems Security Conference, pages 341–352, October 1997.
ITU. ITU-T Rec. X.509 (revised). The Directory-Authentication Framework, 1993. International Telecommunication Union, Geneva, Switzerland.
B. Jaspan. GSS-API Security For ONC RPC. In Proceedings of the Symposium on Network and Distributed System Security, pages 144–151, San Diego, CA., February 1995.
P. Kaijser. A review of the SESAME Development. In C. Boyd and E. Dawson, editors, Proceedings of the 3rd ACISP Conference-LNCS 1438, pages 1–8. Springer-Verlag, 1998.
J. Kohl and C. Neuman. The Kerberos Network Authentication Service V5, September 1993. RFC1510.
J. Linn. Generic Security Services Application Program Interface, September 1993. RFC1508.
J. Linn. Generic Security Service Application Program Interface Version 2, January 1997. RFC2078.
B. Nowicki. NFS: Network File System Protocol, 1989. RFC1094.
T. Parker and C. Sundt. Role Based Access Control in Real Systems. In Compsec’ 95, October 1995.
R. Sandhu, E.J. Coyne, H.L. Feinstein, and C.E. Youman. Role-Based Access Control Models. IEEE Computer, pages 38–47, February 1996.
R. Srinivasan. Remote Procedure Call Protocol Specification Version 2, 1995. RFC1831.
R. Srinivasan. Xdr: External data respresentation standard, August 1995. RFC1832.
J. Steiner, B. Neuman, and J. Schiller. Kerberos: An Authentication Service for Open Network Systems. In Proceedings of the USENIX Winter Conference, pages 191–202, Dallas, Tx., February 1988.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 1999 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Ashley, P., Broom, B., Vandenwauver, M. (1999). An Implementation of a Secure Version of NFS Including RBAC. In: Pieprzyk, J., Safavi-Naini, R., Seberry, J. (eds) Information Security and Privacy. ACISP 1999. Lecture Notes in Computer Science, vol 1587. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-48970-3_18
Download citation
DOI: https://doi.org/10.1007/3-540-48970-3_18
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-65756-9
Online ISBN: 978-3-540-48970-2
eBook Packages: Springer Book Archive