From 6d5ce2bb63445e9c09c3b5c29fb18983e1e2628c Mon Sep 17 00:00:00 2001 From: Mark Johnston Date: Tue, 23 Apr 2024 12:51:03 -0400 Subject: [PATCH] nfsserver: Default to nfs_reserved_port_only="YES" This setting causes the NFS server to check that all RPCs are sent from a privileged (<= 1023) port, rejecting those that are not. This slightly raises the bar for a user with network access to an unauthenticated NFS server to access exported NFS filesystems. Users that use traditional NFS clients (e.g., those provided by FreeBSD or Linux) should not see any difference, assuming that unprivileged filesystem mounting is disallowed. Note that the setting is per-VNET, so may be overridden in VNET jails without affecting the rest of the system. Discussed with: freebsd-arch@ Reviewed by: rmacklem, bz, emaste Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D44906 --- libexec/rc/rc.conf | 2 +- sys/fs/nfsserver/nfs_nfsdkrpc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libexec/rc/rc.conf b/libexec/rc/rc.conf index 96dd0c534dc..6a8b6e257b1 100644 --- a/libexec/rc/rc.conf +++ b/libexec/rc/rc.conf @@ -386,7 +386,7 @@ nfs_server_maxio="131072" # Maximum I/O size for the nfsd. mountd_enable="NO" # Run mountd (or NO). mountd_flags="-r -S" # Flags to mountd (if NFS server enabled). weak_mountd_authentication="NO" # Allow non-root mount requests to be served. -nfs_reserved_port_only="NO" # Provide NFS only on secure port (or NO). +nfs_reserved_port_only="YES" # Provide NFS only on secure port (or NO). nfs_bufpackets="" # bufspace (in packets) for client rpc_lockd_enable="NO" # Run NFS rpc.lockd needed for client/server. rpc_lockd_flags="" # Flags to rpc.lockd (if enabled). diff --git a/sys/fs/nfsserver/nfs_nfsdkrpc.c b/sys/fs/nfsserver/nfs_nfsdkrpc.c index 022f7403d28..ce1189d4042 100644 --- a/sys/fs/nfsserver/nfs_nfsdkrpc.c +++ b/sys/fs/nfsserver/nfs_nfsdkrpc.c @@ -82,7 +82,7 @@ int newnfs_nfsv3_procid[NFS_V3NPROCS] = { SYSCTL_DECL(_vfs_nfsd); -NFSD_VNET_DEFINE_STATIC(int, nfs_privport) = 0; +NFSD_VNET_DEFINE_STATIC(int, nfs_privport) = 1; SYSCTL_INT(_vfs_nfsd, OID_AUTO, nfs_privport, CTLFLAG_NFSD_VNET | CTLFLAG_RWTUN, &NFSD_VNET_NAME(nfs_privport), 0, "Only allow clients using a privileged port for NFSv2, 3 and 4");