Date: Fri, 24 Jul 2020 11:57:51 +0100 From: Matthew Seaman <matthew@FreeBSD.org> To: freebsd-questions@freebsd.org Subject: Re: Technological advantages over Linux Message-ID: <fe6ae329-16fd-825f-74cb-f84155b51c89@FreeBSD.org> In-Reply-To: <CAGBxaXnyWnVYVrrngMGXhpevRn5ZBou9kKcE-4EmDmfdgoXhUg@mail.gmail.com> References: <20200214121620.GA80657@admin.sibptus.ru> <20200724032840.GA61047@admin.sibptus.ru> <bb4b45c49da2c1b3a4cb66512eb52b710c7d1da7.camel@adminart.net> <CAGBxaXnyWnVYVrrngMGXhpevRn5ZBou9kKcE-4EmDmfdgoXhUg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --EkJ1yU6Su6k5YlwaNsgPNNIKS36NlZgP7 Content-Type: multipart/mixed; boundary="OMmndxJtU6WZI4jC18UKGfdnWAc4GlfIw" --OMmndxJtU6WZI4jC18UKGfdnWAc4GlfIw Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: quoted-printable On 24/07/2020 11:17, Aryeh Friedman wrote: > On Thu, Jul 23, 2020 at 11:59 PM hw <hw@adminart.net> wrote: >=20 >> >> You can add that NFS in FreeBSD is a catastrophy. Bascially, you can = only >> export whole file systems with permissions applying to the whole file >> system, and that practically makes NFS unusable. That means >> >=20 > Then please tell me server that it is not working according to your > incorrect pre-conceived notions that you got from god knows where (almo= st > certainly not actually trying them): >=20 > aryeh@server% df -k > Filesystem 1024-blocks Used Avail Capacity Mounted on > zroot/ROOT/default 746429772 8341664 738088108 1% / > devfs 1 1 0 100% /dev > zroot/var/mail 738088368 260 738088108 0% /var/mail > zroot 738088196 88 738088108 0% /zroot > zroot/var/crash 738088196 88 738088108 0% /var/crash > zroot/usr/home 743229452 5141344 738088108 1% /usr/home > zroot/var/audit 738088196 88 738088108 0% /var/audit > zroot/var/tmp 738088196 88 738088108 0% /var/tmp > zroot/var/log 738089452 1344 738088108 0% /var/log > zroot/tmp 738095972 7864 738088108 0% /tmp > zroot/usr/src 739510796 1422688 738088108 0% /usr/src > zroot/usr/ports 740825596 2737488 738088108 0% /usr/ports > aryeh@server% cat /etc/exports > /usr/local/com -maproot=3Droot -network 192.168.11/24 > /usr/home -maproot=3Droot -network 192.168.11/24 > aryeh@server% logout > Connection to server.lan.fnwe.net closed. > Desktop@neomarx% df -k > Filesystem 1024-blocks Used Avail Capacity Mounted= on > /dev/ada1p2 964663364 689635324 197854972 78% / > devfs 1 1 0 100% /dev > server:/usr/home 743229392 5141336 738088056 1% /usr/ho= me > server:/usr/local/com 746429720 8341664 738088056 1% > /usr/local/com >=20 While it is certainly possible to NFS export and mount subdirectories of a partition or ZFS, it is also something where there have been a number of exploits allowing a client machine to break out of the sub-tree allocated to it and see the contents of the rest of the partition. I don't think that is a current vulnerability in FreeBSD, but best practice IMHO is to put your exported directory trees into a different partition or partitions (ZFSes in this case) than the root of your host system -- particularly not in the same ZFS as /etc. Cheers, Matthew --OMmndxJtU6WZI4jC18UKGfdnWAc4GlfIw-- --EkJ1yU6Su6k5YlwaNsgPNNIKS36NlZgP7 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEGfFU7L8RLlBUTj8wAFE/EOCp5OcFAl8avq9fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDE5 RjE1NEVDQkYxMTJFNTA1NDRFM0YzMDAwNTEzRjEwRTBBOUU0RTcACgkQAFE/EOCp 5Of1Mg//TCa1+ixdQpvrg8yUzSJG+e6IgTMfmOp/qNVMvLsa8zu4WbpoRBvfNiVw oiI7WvZfwJr3HerBBdVON+sdLVl30lvfz9RUCwCfleEQ+DIR4X7ijBnMWp/zpnx+ WPJy4MZiArH2mN2jOrKUyzo4IDxfDQvj2lsHdAzQulVlvjxlD7a09keWTlM0Lvol WVEzPAAo18VLVj/NHy4/LXWPRhIl4G8/MGmbM0PhQcCrk3fF5xPSXxhcSsfOJS5P +OUs25dTR+kKN1BYIGysvaePCML68+Q6LcTeCh4dAdv6Wpa86WpGaQj6nzV2Iyic 4tfPcjCAcnXN8YMcXgAvnoM7xNHLVfsWRz7VxSt2cto2FJz9NdsL0jho+X9yS5nd nJnmtKaBtt3WpMAGanZ8E8L3xS2yKuqrO0YK9Tsq8LV3H+AQTq2Br3W9kgvUsqHM rksk3DJBhbAzLXPEWmokZhIJQDCYX7RvAowj7S9rF1B5hKioxKX2k9xriYgMCvKa JXqROy+xarNs6gL5UtM6ti+pvTVHQjN6d7FcnzasIY17w3eTXh+uP9RjhmwBA7ZE Kkz8gMRm+4DGgJDADTfHfeIRjssZteLF3EXZd9s3KTFzqPicWPF9+4pjfYbpJP8V xyUdY6lOdq95za+VkUYZVaifM1if28n1mwuctZBEfXIl0FKeYMk= =7msV -----END PGP SIGNATURE----- --EkJ1yU6Su6k5YlwaNsgPNNIKS36NlZgP7--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?fe6ae329-16fd-825f-74cb-f84155b51c89>