M04-08 · NFS enumeration

October 25 evening: one core concept at a time

1. What is NFS?

NFS (Network File System) lets a computer use a remote filesystem over a network. On the client, it looks like entering remote data through a local directory.

For example, a company keeps course materials on a Linux server so workstations can use the same materials without maintaining separate copies.

First, distinguish two actions:

• Export: the server decides which directory to share and under what conditions.
• Mount: the client attaches the remote filesystem to its directory tree, for example at /mnt/course. This does not copy the entire dataset onto the client.

Using the share requires network reachability, compatible versions, server permission for the client, and suitable identity and file permissions.

2. What does enumeration examine?

Within an authorized environment, identify exported paths, permitted client ranges, NFS versions, and access conditions. Administrators can compare these observations with server configuration and logs.

A common query syntax is:

showmount -e <authorized-server>

The angle brackets indicate a placeholder. No query was executed for this lesson. The -e option requests the export list, not every file in the share or permission to read and write.

showmount contacts the MNT service. An NFSv4-only server may not expose that service, so a failed query or unavailable list does not establish that NFS is absent. showmount manual

NFSv3 deployments often involve supporting services such as rpcbind and mountd. NFSv4 integrates the former MOUNT functionality and commonly uses TCP 2049. Different versions can therefore require different checks and firewall rules. NFSv4 specification

3. Continuing the previous lesson: who does the server think you are?

UIDs and GIDs from the previous lesson are numeric user and group identifiers. The common sec=sys / AUTH_SYS mode uses numeric identity information supplied by the client. Identical account names on two machines do not guarantee identical numeric identities or permissions.

Interpret access at three levels:

• Client: is this computer within the share's permitted client scope?
• Identity: which user and groups does the server associate with the request?
• Resource: may that identity perform this operation on this path?

On Linux, root_squash maps remote UID/GID 0 to an anonymous identity, rather than treating client root directly as server root. It does not anonymize every user and is not complete security protection.

Similarly, rw permits writes at the export layer, while file permissions and ACLs can still reject specific operations. Exports and identity mapping

4. A concrete example: mounting succeeds, but reading fails

This is a synthetic scenario, not an actual test result.

A company permits only course workstations to use the read-only export /srv/course. A student mounts it at /mnt/course.

• Reading /mnt/course/readme.txt: succeeds.
• Reading /mnt/course/staff.txt: Permission denied.

The evidence establishes that this mount is usable, this read of readme.txt succeeded, and this read of staff.txt was denied.

It does not establish that every file is readable, that the user has administrative access, or that data in the share can be modified.

Next, check the actual request identity, UID/GID mapping, path and parent-directory permissions, ACLs, and server logs. A single error string does not establish a unique cause.

5. Defenses and evidence interpretation

Expose only the necessary data to the necessary clients. When reading is sufficient, use a server-side read-only policy and check file permissions and identity mapping.

sec=sys itself provides no cryptographic protection. Where stronger protection is needed, evaluate Kerberos according to deployment conditions:

• krb5: authentication.
• krb5i: adds integrity protection.
• krb5p: additionally provides privacy protection.

These require suitable infrastructure and configuration. Using NFSv4 does not establish that Kerberos or encryption is enabled. Security options | Protocol security mechanisms

Evidence should record time, server, version, exported path, client, identity, security mode, operation, and response, then compare them with the intended policy. The existence of a share does not itself establish a vulnerability.

6. Quick check

In an authorized environment, you discover an NFS export and mount it successfully, but reading staff.txt is denied. Which conclusion is best supported?

A. A successful mount means every file can be read and written.

B. Mounting succeeded, but this read was denied; identity, path, and permissions still need checking.

C. Switching to NFSv4 will always allow the read.

D. A denial message proves that the server has been compromised.

Reply with your choice and one sentence explaining the difference between a successful mount and a successful file read.