NFS security on Sun 7110 SAN

[apaton]

But could someone still spoof an IP and connect if so it's still limited security for what could be sensitive data?

I agree, thus I said its "not 100% robust but if you trust IP address....". A dedicated network/VLAN for NFS traffic will help slightly. I'm sure this is more than enough security for most environments.

[cookie_monster]

Ok, I just like to have a full understanding of the security implications of any setup I have running.

Thanks.

[Duke]

I will agree its not 100% robust but if you trust IP address and user authentication/mapping (LDAP/NIS/Local users) then your OK.

With the 7110 storage you get close to this. You can restrict which hosts and/or networks can access the a NFS share, then your down to user permissions/ACL's for fine grain file access.

I've used this method for XenSever and ESX, this leaves the PUBLIC network open to CIFS and iSCSI only, as already discussed in this thread.

I thought this was possible too, and at the end of the day this is no worse than the security you have on a Windows server share. However, my question then is what permissions need to be set to allow an ESX host to access an NFS share? In other words, which account do I need to grant access to, is it something like root@esxhost.local, and if so how does the S7000 validate that account?

Does the NFS Exceptions security just work along the same principles as iSCSI initiator security, in that you allow/deny certain hosts (in this case hostnames rather than initiator names)?

Cheers,
Chris

[apaton]

my question then is what permissions need to be set to allow an ESX host to access an NFS share? In other words, which account do I need to grant access to, is it something like root@esxhost.local, and if so how does the S7000 validate that account?

Does the NFS Exceptions security just work along the same principles as iSCSI initiator security, in that you allow/deny certain hosts (in this case hostnames rather than initiator names)?

Cheers,
Chris

ESX mount NFS volumes as the "root" user (UID 0). It term's of NFS "root" is automatically demoted to user "nobody" for security reasons.

So on the S7000 you can do two things

1) Create a share with access control of "nobody" and "other"

2) Under NFS Exceptions select "ROOT ACCESS" check box for specific host

Andy