HUGE SECURITY HOLE!! /homes is nfs exported to WORLD!!!

This is an advisory for a HUGE SECURITY HOLE!!!

This issue will affect any user that may be using ReadyNAS on a routed Internet network (as opposed to NAT) where there may be the very real possibility of an insufficient firewall to protect nfs/UDP traffic.

I have confirmed that this problem exists on:

Model: ReadyNAS Ultra 4 Plus [X-RAID2]
Serial: 2HU2130W00320
Firmware: RAIDiator 4.2.17
Memory: 1024 MB [DDR2]

I was running some nfs tests and ran into the often posted issue of dealing with nfs to mount /homes. I found that I couldn't use rsync to copy to/from any user /home dir so I found it necessary to nfs mount /homes on my Solaris system in order to perform the backups that I needed. Of course I ran into the root_squash problem which made it impossible to reliably backup user directories from my Solaris machine to the ReadyNAS when there were non-user owned files in the various user directories. So I installed the SSH add-on and proceeded to look at the /etc/exports file on the ReadyNAS and found the following configuration for the /homes export:

# more exports

"/backup" host1(insecure,insecure_locks,rw,no_root_squash,sync)
"/media" host1(insecure,insecure_locks,rw,no_root_squash,async)
"/vault" host1(insecure,insecure_locks,rw,no_root_squash,sync)
"/homes" *(insecure,insecure_locks,rw,sync)

# exportfs -v

/c/backup host1(rw,wdelay,insecure,no_root_squash,no_subtree_check,insecure_locks)
/c/media host1(rw,async,wdelay,insecure,no_root_squash,no_subtree_check,insecure_locks)
/c/vault host1(rw,wdelay,insecure,no_root_squash,no_subtree_check,insecure_locks)
/c/home <world>(rw,wdelay,insecure,root_squash,no_subtree_check,insecure_locks)


The various other shares were limited to 'host1' but the /homes entry was just '*' !!

At first I didn't believe what I was seeing and thought that perhaps the ReadyNAS was using hosts.allow/hosts.deny to limit nfs access to the local network which is an ok but not great approach. Unfortunately looking at those files revealed no filtering at all!!

OK, perhaps there are some ipfilters defined that I haven't found - but nope none there!

So, to confirm that there appeared to be NO SECURITY limits for /homes, I just attempted to mount /homes on another Unix box outside the local network and presto - /homes mounted - :evil:

This level of security hole is nothing short of UNBELIEVABLE

As has been noted in other posts - Frontview does not yet provide support for limiting nfs access to /homes shares which was considered to be a minor annoyance but I can now confirm that if 'Export home shares over NFS' is enabled then the /homes tree can be mounted by any host!

This security problem can be alleviated by using the SSH add-on (thank you for this great feature!) and modifying the /etc/exports file to replace the '*' with the hostname that you want to restrict nfs access to the /homes tree however, as SSH access is a geek-level add-on feature, any user that is using just the Frontview web interface will be blissfully unaware of this HUGE security hole!

I hope that Netgear will take quick and immediate steps to release an Update to RAIDiator as soon as possible so that the same NFS and Rsync security can be applied to the /homes user shares as all other general shares on the ReadyNAS. Actually it would sure be nice if the /homes share was added to the Share Listing page so that it can easily be found and managed the same way all of the other shares are managed through a common interface.

Overall, with the exception of this security hole I am impressed with the ReadyNAS product and I am looking forward to integrating into my networks as it has shown to have a very full set of features and works well in a heterogeneous computing environment.

---
Bob