HomeFreeBSD

nfsserver: Default to nfs_reserved_port_only="YES"

Description

nfsserver: Default to nfs_reserved_port_only="YES"

This setting causes the NFS server to check that all RPCs are sent from
a privileged (<= 1023) port, rejecting those that are not. This
slightly raises the bar for a user with network access to an
unauthenticated NFS server to access exported NFS filesystems.

Users that use traditional NFS clients (e.g., those provided by FreeBSD
or Linux) should not see any difference, assuming that unprivileged
filesystem mounting is disallowed.

Note that the setting is per-VNET, so may be overridden in VNET jails
without affecting the rest of the system.

Discussed with: freebsd-arch@
Reviewed by: rmacklem, bz, emaste
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D44906

Details

Provenance
markjAuthored on Apr 23 2024, 4:51 PM
Reviewer
rmacklem
Differential Revision
D44906: nfs: Default to nfs_reserved_port_only="YES"
Parents
rGfb2ab7ce52d3: Add test for pthread_sigqueue(3)
Branches
Unknown
Tags
Unknown