Windows to Linux Migration - File Server Security? 103
Circuit Breaker asks: "I'm in the slow process of migrating my office from Windows to Linux. The servers have been Linux machines for quite a while now: Samba serves as PDC/BDC (not using Active Directory yet), and the Samba config is mirrored with rsync; all works well. No, it's time for the workstations, and all is NOT well. User lists are synchronized with NIS, which sort-of works, and will probably work better once we implement LDAP; but it seems that mounting of server directories can only effectively be done with NFS, which is a problem with security because some people really need local root. I've tried using NFS, CIFS and SSHFS, through pam_mount, automount, and independently, but it's not close to the usability of the Windows setup. It's either mounted per user, which requires a lot of work, or by root, in which case local root users bypass any remote permissions. How do you set up mounting directories that is easy to use like Windows -- everything automounted, but security settings are still respected for each user, even when local roots are involved?"
If it works now (Score:4, Insightful)
Re:If it works now (Score:1, Informative)
Re:If it works now (Score:2)
You just need the correct setup and firewall.
You Are Correct! (Score:5, Funny)
[ 289 patches, 112 tweaks to services, sixty-eight re-boots, a half-dozen add-on packages -- Norton, AdAware, etc. -- and fourteen hours later... ]
See?
Re:You Are Incorrect! (Score:1, Interesting)
AdAware? Is that how you imagine Windows servers must be run? Why would someone need AdAware, which blocks spyware and cleans up private web browsing information, on a server? Do you flip through all your favorite sites on your production Linux servers?
Norton? Why would someone need Norton (presumably Internet Security for the firewall and AV for virus sca
Re:You Are Incorrect! (Score:1)
???
You posted a correction to say that the Windows default with SP1 is "secure"
???
Try running nessus or even nmap against it.
Try referring to NSA guidelines for securing a windows 2003 server environment.
http://www.nsa.gov/snac/downloads_win2003.cfm?Menu ID=scg10.3.1.1 [nsa.gov]
Or read some of the SANS whitepapers:
http://www.sans.org/rr/whitepapers/windows/ [sans.org]
Windows machines can be hardened to a degree, but never as much as it's possible to harden linux or bsd's because they can be streamlined much much more by tossing
Re:If it works now (Score:4, Informative)
Pick your favorite reason. But ultimately, whatever the reason, I'm sure they have a good one and have decided the pains involved with migrating over are worth moving away from what they are using now.
Re:If it works now (Score:2)
SOX is just to far-reaching to try to save a buck by going the Redmond route...hire real professionals.
Re:If it works now (Score:3, Interesting)
It is always dangerous to become dependant on a single source for anything. No other vendor produces a windows-compatible OS or other drop in replacements for their products, your always faced with a costly migration. Unlike with x86 hardware (dell, hp, ibm, acer whatever, you can easily drop in replacements) and linux (debian, redhat, suse, easy enough to change) w
Re:If it works now (Score:1)
Although then again, all the random crashes do look like they happen around the right place...
NFS with Kerberos (Score:3, Informative)
Re: (Score:3, Informative)
Re:NFS with Kerberos (Score:2)
You sure about that?
I've used the standard version of Kerberos. It comes from MIT and there are no licensing agreements. It's free. I've also browsed through the docs on using NFSv4 (with Kerberos) and have never seen any mention of a license.
Also, the company you have linked to is in South Africa. So... any concerns about exporting crypto would seem to be moot.
Re:NFS with Kerberos (Score:1)
NFS options (Score:5, Informative)
Recent NFS kernel implementations (for instance, whatever I have installed on my Debian/Sid boxen) have a few options which might be useful.
First, in /etc/exports, you can do per-IP-address UID/GID squashing. 'man 5 exports' considered helpful. For instance (Slashdot will mangle this),
That will make the NFS connection from 10.60.55.20 have all access go via UID/GID 1001, and all accesses from 10.60.55.30 go via UID/GID 1002. This is most applicable when using single-user endpoints/workstations.
Newer kernels (late 2.6.x-series) appear to have support for Kerberos and similar; of course, if you haven't even done LDAP yet (what's your excuse? If you're replacing Windows machines in an NT4 configuration, you should at least be migrating to something LDAP-based), then Kerberos is probably out of your league. Fix that.
Re:NFS options (Score:3, Informative)
Where I once worked, our drives were all mounted via nfs. I could be on a local linux box and become root, but that didn't give me root access to the mounted drive. In fact, as root, I couldn't even see my own user files on the remote machine. If I wanted to do root-like things on the remote end, I had to log in there to do it. I've always assumed this was a defult way that NFS worked.
This was more than 8 years ago, so I don't think it's anything new.
Re:NFS options (Score:1)
You are correct. Only linux calls it "root_squash" but all the major unices have had exactly the behaviour you described for a decade or more.
This entire "ask slashdot" article is moot because of that.
Re:NFS options (Score:3, Informative)
I'm glad to hear that. I was afraid it was just my faulty memory - remembering what wasn't.
Maybe this guy has his nfs servers' exports file set with "no_root_squash" - which can be handy while trying to get things working - but never turned it off when it was done?
I think for added security on the file server, all accounts but a select few had their home and shell set to
Re:NFS options (Score:1)
Yep - as long as you give access to accounts with the privilege to su, you've got that problem. But, it is not NFS specific - as long as the file-server trusts a user on the machine to be themselves, you've got that concern.
Re:NFS options (Score:3, Insightful)
A good security (Score:1)
By educating and training the users, there should be a minimum amount of confusion. But if you want to be 100% sure that files are being maintained, make at least daily backups so that if someone edits the document inadvertently then you can restore it.
Make sure you get a manager and director to approve the security policy and get a signature from each staff member so that t
Re:A good security (Score:1)
By the way, doubt this will really be useful for anyone but I don't really use NFS much for my own systems – too slow, and requires a network connection the entire time you're working. Usually I
Re:A good security (Score:2)
Re:A good security (Score:1)
Re:A good security (Score:1)
Re:A good security (Score:2)
Local offline cached version controlled repositories, with a centralized SVN or HTTP master for the entire workgroup to use. It's a minor change in workflow, but the benefits in reliability and accountability are tre
Re:A good security (Score:5, Insightful)
IMHO, this is just asking for trouble. And having daily backups only ensures that you'll spend most of your day restoring backups when things start to get really messed up. Getting a signature doesn't do you squat, unless there is a real policy of enforcement. But once mangaement realizes they're going to have to discipline everyone because your security policy is lame, who do you think is going to get it in the end.
Re:A good security (Score:1)
Why are you doing this? (Score:5, Interesting)
But everything you've described is "we're trying to find a way to emulate this Windows functionality on Linux, and it's really hard". You're taking huge amounts of time, you can't get anything to work properly, and in the process I imagine you're causing your users a lot of aggravation.
I don't even want to know how big the office is, what sort of packages you're trying to migrate, etcetera, but presumably either you're in charge of a very small office, your manager is a Linux idealist or the majority of your office colleagues are Linux idealists, or you made it sound really appealing to your manager. If the first two reasons, I'd be guessing sheer stubbornness is making you carry this on through. If the last, I'd be guessing your manager will be asking some questions sometime soon.
So why are you doing this? Heck, just read the last few sentences...
I've tried using
It's either mounted per user, which requires a lot of work, or by root, in which case local root users bypass any remote permissions.
How do you set up mounting directories that is easy to use like Windows?
Mate...again, why, precisely, are you doing this? Now I really do want to know out of sheer curiosity...
Because someone got bitten by the Linux bug (Score:5, Interesting)
Happened to me at my last job. We needed an Oracle server for a project, had to be Oracle. No problem, we have a site license for it so there's no incrimental cost. We get a server, and then it falls to me to set it up. However I'm told it has to be on Linux. I'm given various reasons, all, none valid. Things like "Well Linux is more secure" though the server will be in private IP space, directly conected to another server. So I start fighting with various LInux distros and Oracle to no end. I finally get fed up with this shit and tell the people demanding Linxu if they want it, they can install it. The UNIX guru comes to try it, fighs with it for like a week and finally calls Oracle since we have support. Their reply? "You need to get a supported OS, until then we can't help you."
See we were trying regular SuSe and Redhat. Part of the whole Linux thing is it's free right? Oracle will have nothing to do with that at all. Supported Linuxes were RHEL, SuSe EL, and UnitedLinux. So we hit a roadbloack. I asked for permission to try Windows XP since that was a supported OS, the system had come with a license and why not. Oracle ended up installing on that fine on the first try and working properly. Then the project was canceled, but that's another story.
Nobody who was demanding Linux there ever gave any thought to if it was the right way to so things, it was just pushing Linux or, I suspect, pushing something not MS.
So I'd bet that's what's going on here. Perhaps the submitter is in a bad situation where management has made an uninformed decision that they must be using Linux, and now he has to try and make it happen, even though it's a problem. Could also be he's a guy who dislikes MS and has used Linux at home, and decided it would be good for work without doing proper research.
Re:Because someone got bitten by the Linux bug (Score:3, Insightful)
I'm not saying Oracle is easy to install, but you can do it for sure in a couple of hours (less if you are using a supported Linux and follow the installation instructions).
And using Windows XP as the operating system for a database server? Are you kidding?
Re:Because someone got bitten by the Linux bug (Score:5, Insightful)
And it sounds like you are another one bitten with the LInux bug, or rather the "anything but MS" bug. Why not Oracle on XP? I would draw your attention to the fact that it's an offically supported OS, as in Oracle themselves have declared "This OS is suitable to use with our database, and we will support installations on it." 10g2 is offically supported on Windows 2000 (Pro and Server), XP (32 and 64-bit) and 2003 Server (32 and 64-bit). While I haven't played with 10, when we did all this with 9, it installed on XP on the first try with no problems.
So what's your reasoning that XP can't be used? Is there something really backing it up or is it just general "You can't use Windows" mentality?
I'm not saying I'd recommend using Oracle on XP in most cases, however this is the same, knee-jerk "Linux bug" mentality I'm talking about. A Windows solution works, there's no problems with it, however you get this atitude like it should be Linux just because.
Change needs to have a reason, at least in the corperate world. That reason can be something as simple as "we are tired of paying for MS licenses" but you need a legit reason. "I hate MS" isnt' a legit reason. Further, the benefits of the switch must outwiegh the costs. If you can switch to Linux with no additonal support costs, then the cost argument is a good one. If switching to Linux is going to require 500 man hours to implement and an additonal 200 per year to support over Windows, it may well be that the money spent on support is more than the savings from licensing.
Re:Because someone got bitten by the Linux bug (Score:4, Insightful)
I am sorry, but I am calling bullshit on this. Yes, Oracle can be difficult to install on a Linux installation that is not "supported" because it makes a lot of assumptions about the services that will be available to it. BUT any competant admin can find out what the requirements are without a lot of difficulty. And in many cases there are guides that can be used to install Oracle on non-supported systems.
One such guide is the following:
http://www.tldp.org/HOWTO/html_single/Oracle-9i-F
So what's your reasoning that XP can't be used?
As far as Oracle running on Windows XP, the main reason that I wouldn't do that is that Windows XP doesn't provide the services that a server OS would. For example, such an installation would be limited to no more than 10 concurrent users, amoung other things.
Re:Because someone got bitten by the Linux bug (Score:2)
That's what CentOS is for - to emulate RHEL. The guides are great for that.
That said, Oracle made the install for XP incredibly easy, and there's no shame in using that either.
Re:Because someone got bitten by the Linux bug (Score:2)
Another reason would be cost, oracle is expensive enough already without having to pay for windows as well.
Re:Because someone got bitten by the Linux bug (Score:2)
Re:Because someone got bitten by the Linux bug (Score:2)
If your using Postgres or Mysql then the installation issues are moot, since both come by default with several linux distributions anyway.
Because someone got bitten by the Oracle bug (Score:1)
If it is giving you all this trouble on Linux, why not choose another SQL server? Or is it ok to be bitten by the Oracle bug?
Re:Because someone got bitten by the Linux bug (Score:2)
The installation script explicitely check for supported Linux distribution. Failing that, it refuse to install. The fix take about 5 minutes to implement, and is easy enough to find on Google if you do not know what you are doing (basically, copy /etc/redhat-release from a supported RedHat version t
Re:Because someone got bitten by the Linux bug (Score:1, Insightful)
This was some wanker who had installed Linux a couple of times on his PC in Mom's basement and now he's a "Linux Expert".
Re:Because someone got bitten by the Linux bug (Score:2)
Why is this guy given the task to set it up on linux - wouldn't it make sense to have someone familiar with the platform do it?
To be brutally blunt and assuming it is a serious question - because XP is a hobby OS and MS Server2003 which is designed better for the task doesn't really cost much more.
I agree about the change bit - if the constraint is to make it behave like MS Windows
Re:Because someone got bitten by the Linux bug (Score:4, Insightful)
Re:Because someone got bitten by the Linux bug (Score:3, Informative)
As for running Oracle on windows, it's far more secure to run it on Unix...
Oracle on windows runs as SYSTEM, whereas on unix it runs under it's own "oracle" account. Any vulnerability found in Oracle becomes far more serious on windows than on unix.
Re:Because someone got bitten by the Linux bug (Score:2)
Going to Oracle and saying "well, CentOS is fully compatible with RHEL" isn't going to work.
This is the problem with Linux vs Unix arguments in the enterprise; Linux may be free to download & use on commodity hardware, but is that really what you'll do? Most people will buy mid to high-end servers with redundant power etc & use RHEL/Suse EL which winds up about the same price as commercial Unix on equivalent hardware.
Re:Why are you doing this? (Score:2, Interesting)
An organization like Free Shell [freeshell.org] uses NFS for all user accounts and much of their core orginization.
If I could use NFS, I'd fill an older computer with hard drives so I could have a massive file server. I know Google has the answer, but you have to admit, if someone on slashdot had the answer, it'd be nicer to get it here, then dig through pages and
Re:Why are you doing this? (Score:1)
Yes! Because it's so much more productive to dig through pages and pages of
Re:Why are you doing this? (Score:4, Interesting)
You're right -- in the short term this is more trouble than it's worth. There are a lot of things he needs to learn, and the initial setup can be difficult and time consuming when you have never done it before. The payoff only comes in the long run.
Imagine how much your company would have saved in licensing costs if they had migrated to open source software in 1995. Imagine how easy it would be to support Linux if the IT staff and employees had 10 years of solid Linux experience.
This guy's company is going to be in a great position in 2015, and people who couldn't tolerate some short term inconvenience will be even further entrenched in a single-source solution. In fact, I think the Linux migration will more than adequately prove itself financially much sooner -- by the time his friends are in the middle of a Vista migration. (I'll resist the temptation to insert a cheap shot about 2015 here).
As for the original question, I would suggest if he wants something that shares files like Windows, to use Samba. It's not just for interoperability; KDE and Gnome both integrate with Samba very nicely.
Re:Why are you doing this? (Score:2)
No, they'll be entrenched on Linux, while the Hot Thing will be Hurd ;).
Re:Why are you doing this? (Score:2)
OSS is making great strides, becoming more usable with each passing year, but I strongly doubt going OSS for everything now will be cheaper than running on existing licenses for another few years, and switching then.
10 years is an awful long time in this industry.
GNOME is almost 9 years old, and it's only just become usable for end-users.
Re:Why are you doing this? (Score:2)
When Windows Vista comes out, there will be all sorts of pressure to migrate to it. This guy picked the perfect time to switch so that he has time to do it right, before that pressure hits. It's the kind of foresight I expect from a company that would be able to see past the short term hassle of switching operating system suppliers in the first place.
one word (Score:3, Informative)
What I don't understand (Score:4, Interesting)
Yes, there are advantages to having clued users able to do things on their systems [1] -- which is quite a different thing from having root access to the network stores.
In other words, I don't see the problem unless you've created it.
[1] Example: my system at $WORK. Note that most of the other engineers neither have, nor need, root access and I neither need nor have root access to anything but my own box.
Re:What I don't understand (Score:2)
Re:What I don't understand (Score:3, Informative)
sudo enables "restricted" root access (Score:1)
RTFM
If you would peruse the sudo documentation, you'd realize it is possible to customize it to allow particular users to execute particular commands as root.
Even without sudo, it's possible to allow only very specific actions as root by using chmod suid magic.
Of course, every time you use either of these methods, your security is lessened with respect to the next vulnerability found in sudo or whatever application you've authorized the user to run as root. But I did not get the impression that the
Re:sudo enables "restricted" root access (Score:2)
Re:What I don't understand (Score:2)
Personally, I think Ubuntu and Mac OS X get it right in disabling root by default. BTW, I'm a Fedora user.
Re:What I don't understand (Score:2)
Samba serves as PDC/BDC (not using Active Directory yet)
Apparently, he's planning on running Active Directory on Linux?
That's something I'd like to see!
Re:What I don't understand (Score:1)
What I believe he meant is that, since he's using Samba on his Linux servers to replicate the file sharing/domain functions of Windows (NT), he doesn't have the ability to do Active Directory-like stuff yet (since the current Samba v3 implementation doesn't support it).
If you'd like to see it, you might not ha
local root (Score:1)
Re:What I don't understand (Score:2)
Re:What I don't understand (Score:2)
Which doesn't explain the need to have users running Linux as root.
Fish? (Score:2, Informative)
Fish is a file-system-over-ssh setup, that only requires ssh access, with perl being optional. It respects all the permissions a ssh account would.
Konqueror also has Kioslave for a crapload of other protocols, including nfs, so it would be worth looking into even if you don't like fish.
http://www.garni.ch/fish/ [garni.ch]
kde.org
AFS (Score:3, Interesting)
smbmount (Score:4, Informative)
Yes, it's part of the Samba package.
Yes, it does exactly what it suggests: mounts a Samba share (the same thing you were doing when you were using Windows)
So, point one: you do not need to use NFS
Now let's go for point two. And I will not extend here. Just a tip: man fstab, then go to the fourth field (options) and look for help on the "user" option.
All your problems fixed.
Re:smbmount (Score:2)
Aside from that, the user= option isn't terribly secure if the user has local root on the system.
NFS with kerberos is a much better idea.
Re:smbmount (Score:1)
Re:smbmount (Score:2)
Yes it is, if when the server comes back the processes unhang and go back to normal as if nothing happened.
As opposed to an SMB connection which is just plain broken at this point and will likely require a manual umounting/remounting. God help you if you have an application that's open that uses the share, can't be kill -9'd because the samba share is hanging, and you can't umount the share becau
Re:smbmount (Score:2)
Also, you can specify various mount options for NFS, the key ones being:
hard
intr
soft
Soft will behave like samba, any disconnection will break file locks and cause fuckups on any program accessing the NFS, but the rest of the system will remain up
Re:smbmount (Score:1)
Seriously (Score:3, Insightful)
What's wrong with using NIS/+/ldap with automounting nfs homedirs? Root, from arbitrary machines, should have no reason to access mounted homedirs, and the users can still do local root.
How is that hard?
Don't want to automount? Add a line to
The whole super custom complex setups, the kind you're digging yourself a into hole for, are the #1 cause for:
1. Hard to troubleshoot problems/issues.
2. Poorly performing infrastructure.
3. Security vulnerabilities.
4. Networks that are hard to make redundant.
KISS
Re:Seriously (Score:2)
Those issues are hard to rectify when they're all placed to together.
Re:Seriously (Score:2)
Yeah, I guess introducing them on purpose is one way to avoid accidents...
Re:Seriously (Score:2)
What is your problem with NFS? (Score:2)
Really, comparing windows file sharing to NFS and mentioning the word "security" - is the article a troll by someone trying to score points for MS or is the question being asked before reading even the man page?
Both NFS and CIFS/SMB do have serious issues that prevent them from being used on a
Re:What is your problem with NFS? (Score:2, Informative)
$ su -
# su - someuser
And have all access as 'someuse
Re:What is your problem with NFS? (Score:2)
Obviously, but if you can't trust them to be any user on the machine then they shouldn't have root - and at the most basic level the /etc/exports file limits access by machine to only those machines that should be permitted to connect to the filesystem. It does require clearly defined administrative limits of where different users should be allowed to go and either full awareness of where those users will work or users well practiced in using ss
Network filesystems is a *nix joke (Score:2)
Unix is written for One Big Server with network services. Exposing the file systems across the LAN is a very unfunny joke and that's why people end up sticking with Samba!
Here's something you could try (Score:1)
Re:Here's something you could try (Score:1)
Re:Here's something you could try (Score:1)
The host can then make it a user based who, but you are trusting the host to do that. So if you have a user that is in control of that host they can acquire maximum available rights on filesystem exported to the host.
Also because in vanilla NFS you are exporting with IP based security all someone has to do is steal the hosts IP to themselves acquire this access.
Maybe this is naive (Score:3, Informative)
root is root is root is root (Score:3, Informative)
How do you set up mounting directories that is easy to use like Windows -- everything automounted, but security settings are still respected for each user, even when local roots are involved?"
For directories the use of auto mount functions is best.
But as the title of this suggests - root is root is root ...
It is generally overstated 100% of the time that many users need local root for anything. They should be using "sudo" if they need to cancel print jobs, or add users. Indiscriminate delegation of root is insecure and a bad practice. Please examine the "local" need for root, I think you will find it is not needed. The sudo config file can also be rsync'ed.
In fact, in my environment UNIX Admins don't have the root password except for 2. The other admins use sudo to a shell. Users use sudo for printer management. The "identity management" uses sudo. Even when users want to mount directories they use sudo. Want to shutdown the machine or make backups, use sudo.
Only trusted and a few admins get interactive command line access as root.
I do concede, Windows is easier as in fact almost everything with the system runs as the admin including the users. Down right insecure. And can't be made secure and still run. UNIX/Linux is not this way but takes some rational thought.
Over NFS, consider keeping the nosuid/non-root access. Consider using groups to control access. So if a normal user ID has membership in group1, and the directory is read-write to group1 they have access. You might say, users who create files in this directory don't set the groups right... then you need to support the setgid bit on directories and umask settings. scrimant delegation of root is isecure and a bad practice.
you should specify why your users need local root (Score:1)
Most user data is NFS supplied and not root-enabled. This causes almost no problems.
Can you describe in detail what your users need (or expect, generally a larger list).
Root power is surprisingly rarely needed if your setup is good. Without details, your i
Set local UID to zero (Score:2)
Welp, mod me redundant if I missed it but I just all the posts and didn't see the obvious answer...
When sync'ing the user info tweak your script to set the user number to zero on the workstations (or whatever the "local" machine is).
That way username can be "joebob", and user joebob (with a non-zero id) has restricted ri
Re:Set local UID to zero (Score:2)
Including the ability to change user IDs?
Note that the danger here is not root access to the NFS mount. That can easily be prevented. The danger is that someone will spoof another user and get access to their data. If NFS is relying on the local machine to authenticate the user, then the user can't be given root and limited in their actions on the NFS mount.
As someone else pointed out, NFS is not the right tech for this problem. They need
Study NIS, NFS and automount (Score:1)
Upgrade the kernels! (Score:2)
Haydn.