Re: [Users] Best practice for securing oVirt's NFS mounts

2014-03-12 Thread Prakash Surya
On Wed, Mar 12, 2014 at 11:05:34AM +0100, Jiri Belka wrote: > On Tue, 11 Mar 2014 10:23:19 -0700 > Prakash Surya wrote: > > > Hi, > > > > All the documentation I've seen states that the oVirt NFS storage should > > use the "all_squash,anonuid=36,anongid=36" options. Obviously this isn't > > secu

Re: [Users] Best practice for securing oVirt's NFS mounts

2014-03-12 Thread Prakash Surya
Right, and agreed. We've migrated to using kerberos authentication and NFS4 for most of our NFS mounts, but since oVirt requires the all_squash and *ID of 36, that won't work. Honestly, our LAN is fairly well protected and our users are more or less "trusted", so I don't think it's _that_ big of a

Re: [Users] Best practice for securing oVirt's NFS mounts

2014-03-12 Thread Jiri Belka
On Tue, 11 Mar 2014 10:23:19 -0700 Prakash Surya wrote: > Hi, > > All the documentation I've seen states that the oVirt NFS storage should > use the "all_squash,anonuid=36,anongid=36" options. Obviously this isn't > secure, so I'm curious how others have locked down their NFS storage? Is > the b

Re: [Users] Best practice for securing oVirt's NFS mounts

2014-03-12 Thread Sven Kieske
Hi, just a quick reminder: unless you got strong network authentication and absolute control over the LAN it's a bad advice to trust some random IP address. In today's networking world I would advice to not trust any LAN resource without strong authentication mechanisms. Am 11.03.2014 18:23, sc

[Users] Best practice for securing oVirt's NFS mounts

2014-03-11 Thread Prakash Surya
Hi, All the documentation I've seen states that the oVirt NFS storage should use the "all_squash,anonuid=36,anongid=36" options. Obviously this isn't secure, so I'm curious how others have locked down their NFS storage? Is the best option to just limit access to these NFS exports to the IP address