Chapter 9. Network File System Security Considerations
Youcan use the Network File System to create a seamless, transparent namespace
where all users have access to the right information at any given time. However,
NFS also has special security considerations. These considerations deal mainly
with user, group, and supplemental user identifications. This chapter discusses
these concerns along with certain parameters and options of the CHGNFSEXP
command.
This section describes a number of NFS security issues while explaining how to
best avoid security problems and breaches while maintaining a secure namespace.
For more information about OS/400 security, see:
v

Security - Basic,

SC41-4301
v

Security Reference,

SC41-4302

The Trusted Community

The trusted community is made up of only the “approved” NFS servers and clients
that represent a trusted network of users. Inside this group, users export and mount
file systems based on a system of individual responsibility to keep the namespace
secure from outside, non-trusted users.
The other defining feature of a trusted community is that no special data encryption
of any sort occurs in client/server relationships. The transmissions between the NFS
clients and servers are not encoded. Only the applications running on the client will
minimally encrypt and send data between client and server. This is why it is
important to pay attention to how you export files from an NFS server. If the client
and server transmissions are not encrypted, and you export to “the world,” then
anybody can access your exported file systems. For more information on exporting
securely, see “Securely Exporting File Systems”on page 87.
For a detailed discussion of export options, see “Export Options” on page88.
© Copyright IBM Corp. 1997, 1999 81