From owner-freebsd-questions@FreeBSD.ORG Sat Jun 19 14:45:02 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 57B2416A4CE for ; Sat, 19 Jun 2004 14:45:02 +0000 (GMT) Received: from smtp.infracaninophile.co.uk (happy-idiot-talk.infracaninophile.co.uk [81.2.69.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id DCE3C43D53 for ; Sat, 19 Jun 2004 14:45:00 +0000 (GMT) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost.infracaninophile.co.uk [IPv6:::1])i5JEiWTN045514 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 19 Jun 2004 15:44:32 +0100 (BST) (envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk) Received: (from matthew@localhost)id i5JEiWMJ045513; Sat, 19 Jun 2004 15:44:32 +0100 (BST) (envelope-from matthew) Date: Sat, 19 Jun 2004 15:44:32 +0100 From: Matthew Seaman To: Bruce Hunter Message-ID: <20040619144432.GA45261@happy-idiot-talk.infracaninophile.co.uk> Mail-Followup-To: Matthew Seaman , Bruce Hunter , freebsd-questions@freebsd.org References: <1087233657.662.2.camel@solid.solisixoffice.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="VS++wcV0S1rZb1Fb" Content-Disposition: inline In-Reply-To: <1087233657.662.2.camel@solid.solisixoffice.com> User-Agent: Mutt/1.5.6i X-Greylist: Message not sent from an IPv4 address, not delayed by milter-greylist-1.4 (smtp.infracaninophile.co.uk [0.0.0.0]); Sat, 19 Jun 2004 15:44:32 +0100 (BST) X-Virus-Scanned: clamd / ClamAV version devel-20040612, clamav-milter version 0.72a on smtp.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on happy-idiot-talk.infracaninophile.co.uk cc: freebsd-questions@freebsd.org Subject: Re: NFS Port X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 Jun 2004 14:45:02 -0000 --VS++wcV0S1rZb1Fb Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jun 14, 2004 at 01:20:57PM -0400, Bruce Hunter wrote: > I am able to connect to my NFS system like so > mount 192.168.1.14:/home/NFSave /mnt/coreserver >=20 > I want to connect from outside my network, like when I'm at school. What > port(s) does NFS run off. I have to do port forwarding on my > Router/Firewall. Look at mountd(8) for the server side of managing NFS -- use the '-p' options to specify a port to listen on for NFS mount requests. Port 2049 is the traditional port number for NFS, but portmap(8) generally only treats that as a guideline, so unless you force it, NFS can use just about any high numbered port. Make sure you firewall off port 111 very carefully on any system running portmap(8) [4.x] or rpcbind(8) [5.x] -- (same program, just renamed between system versions) exposed to the Internet. RPC is a favourite and generally very fruitful attack vector. On the client, you will need to use tcp as the transport -- not all clients will support that -- and you can specify what port to contact the server on in /etc/fstab, thus bypassing the usual portmapper procedure. See the descriptions of the '-T' and '-o port' options in mount_nfs(8). As others have mentioned, this would be a good situation in which to use an IPSEC tunnel or similar between server and client -- NFS traffic is vulnerable to snooping and exposes the contents of your harddrive. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK --VS++wcV0S1rZb1Fb Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFA1FFQiD657aJF7eIRAvKHAKCJuM9Uga1GmDtBlOkTg3bqSG/LhACgnxxB ls/C50In3vLcQHt/LahMOGQ= =evGg -----END PGP SIGNATURE----- --VS++wcV0S1rZb1Fb--