Date: Tue, 20 Jul 2010 14:50:03 GMT From: John Baldwin <jhb@freebsd.org> To: freebsd-fs@FreeBSD.org Subject: Re: kern/147940: [nfs] mounting >1k TCP-NFS mounts fails Message-ID: <201007201450.o6KEo3dA074649@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/147940; it has been noted by GNATS. From: John Baldwin <jhb@freebsd.org> To: bug-followup@freebsd.org, rs@bytecamp.net Cc: Subject: Re: kern/147940: [nfs] mounting >1k TCP-NFS mounts fails Date: Tue, 20 Jul 2010 10:42:37 -0400 There are a limited number of privileged ports on a client, only 1k, and some of those ports are used for other services, so you certainly cannot mount 1k TCP NFS mounts unless you disable the privileged port check on the server. nfs_privport=0 is not necessarily a risk if you trust all machines that are able to connect to your NFS server (e.g. you manage all the clients and the server is on a LAN or WAN and not directly connected to the Internet). Even with nfs_privport=1 you are still trusting root on any client machines, nfs_privport=0 only prevents non-root users on client machines from establishing mounts. However, this isn't a bug, this is just the way IP works, and as a result, the way that NFS mounts work. -N for the UDP mounts is effectively similar to having nfs_privport set to 0. I'm not sure exactly how it works (perhaps it requires the mount request to be privileged, but not the normal RPC traffic?), but that is why it is "working". -- John Baldwin
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201007201450.o6KEo3dA074649>