Hey everyone and welcome back. In the previous nugget we had talked about the client configuration
for NFS. Now what we're going to do is we're going to look a little bit closer at how we
can lock down access to our NFS shares using TCP wrappers. Now this is actually a concept we have
visited before if you did the L-PIC1 certification and once again that knowledge is going to come
in handy. So what we're going to do is we're going to see how exactly these TCP wrappers are used
within like I say NFS version number three. So check this out then shall we what we'll do here
is what we will do here is we will quickly refresh the process of how these particular TCP
wrapper files are going to be evaluated. Now you may recall that within the Etsy directory we have
this file called host.allow and also within the same directory we have a file called host.deny.
So check it out the way I've written this here is ultimately how things are going to be evaluated
if you happen to put some type of host definition within the allow file then it's going to be evaluated
as something that should be permitted. Conversely if we happen to put some type of definition within
the deny file then the access is going to be disallowed. Now as it transpires if we happen
to have a host let's just maybe say 192 168 1.1 whatever it may be if we happen to specify that
host within the allow file as well as the deny file how on earth would that be resolved it seems
like it would be a conflict but here is the reality the first file that will be evaluated is going to
be this top one right here the host.allow file. Now if we happen to find a match within this file
the connection is going to be allowed now if there is no definition within the host.allow file
we will then go and check hosts.deny and if we find a definition for a particular host or a
particular network within this file then the connection is going to be disallowed this is
the process we check host.allow first then host.deny and if we do not find any type of match for any type
of rule within either of these files the default setting is to just allow that connection so really
like i say if we have a conflict we will allow that will ultimately override deny and if we do not
have any definition the default behavior is to allow that connection now you may recall that at the
beginning of this skill i talked about how we had the xa exports file and within there we could
actually control permissions remember that within the brackets now this is ultimately specified at
the nfs level but you will also recall is that nfs is going to interact with portmapper at least
nfs version 3 or rpc bind and we know that they can use what we're just talking about tcp wrappers
to ultimately control the access remembering that the tcp wrappers can ultimately undo and override
what we specify within that xa exports file with respect to permissions so this is obviously a very
important thing that we want to be understanding if we happen to have a conflict you want to understand
how we can resolve that conflict and what actually takes effect now if we go and we look into one
of these configuration files so if i happen to go in and say sudo nano into xa host.allow
and hit enter i'll type in my password now to specify that i want to create a rule with respect
to portmap which is going to interface with nfs the way i can actually do this is by specifying
the keyword portmap and then a column after which what i can then do is specify maybe say the host
that i want to allow because after all this is the allow file right here so i could say allow 192
1680.68 i can't actually remember what the client ip address was let's just say it was
68 for argument sake so what i am effectively doing here is allowing this connection from this host
similarly what i could do is if i save this and i then go into xa and go into host.deny
similarly i can specify for portmap with a column i could then say 192 1680.0 slash 24 now think
about the action which has just taken place here i have specified that i want to deny absolutely
everyone on this network you see here this is in the deny and at the same time in my allow file i've
said a host within that network is going to be allowed ultimately what i'm saying is that everyone
within the 192 1680.0 slash 24 network is going to be denied access to the nfs share using portmapper
except for this particular host this particular host is going to be an exception so we're going to
have 192 1680.68 that will be allowed but everyone else within the network will be disallowed so this
behavior really is quite useful and it's not only that what i could do alternatively is if i left
this maybe just say at the same configuration and i go into the deny once again what i could do here
is as opposed to specify maybe say this particular network again i could just list particular host
if i so choose i could just be more specific and say 0.13 would not be allowed or i could say
portmap what i want you to do is to deny all so if i save this again think about it we're casting an
even wider net we are saying that for all devices we want to ultimately deny them except for the
exceptions we have written in the allow file because the allow file is going to be evaluated first
that means that every single device that tries to connect except for 192 1680.68 they're all going
to be denied except for this one particular host and it really is important that we understand
that the definitions that we specify here can sometimes run contrary to the permissions that
we have specified directly within our essay exports file right here but ultimately this is a problem
that is effectively antiquated with version 4 like i say we're not going to have such a clash
the control of nfs is going to be handled natively within version 4 by nfs itself but again for the
purposes of the examination we do want to be aware of the different versions and how we can
actually handle and manage nfs depending on the type of version we have within our system.
Okay doctor that is us for our introduction into nfs security one last thing i want to be talking
about and that is all about the mounting of nsf file systems with persistence and well that's
what we're going to be talking about in the very next nuggets i hope it's been informative for you
and i'd like to thank you for viewing