Hi,

OneFS 9.2.1

We just discovered that the Isilon allows mount requests from NFS clients over unprivileged ports. This is a big security hole. A user, who has restricted access to a NFS mount, can create a SSH port forwarding to the NFS client from a machine where he has root access. Then he gains full access to the mounted export.

You can see on the Isilon with "netstat", that the original mount comes from a privileged port (917):

tcp4 0 0 isilon.node.2049 nfs.client.917 ESTABLISHED

Over the SSH forwarded connection, the client comes from an unprivileged port (37660):

tcp4 0 0 isilon.node.2049 nfs.client.37660 ESTABLISHED

This has to be prohibited. Our IBM fileserver, for example, has the export option "PrivilegedPort" that prevents such connections. Does something like this exist in OneFS? For example in the file /etc/defaults/rc.conf is the option:

nfs_reserved_port_only="NO" # Provide NFS only on secure port (or NO).

But this file seems not to be used by likewise NFS, right?

Regards,

Dirk