Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to connect to my home server from work using NFS. I tried sshfs but some people say it's not as reliable as NFS.

I know sshfs traffic is encrypted. But what about NFS? Can someone sniff my traffic and view the files I'm copying?

I'm using NFSv4 in my LAN and it works great.

share|improve this question
    
Who are the “some people”, and what exactly do they say? –  Gilles May 29 '11 at 21:43
    
NFS is a block level protocol and is sensitive to latency. It's usually used with UDP so you may have firewall issues. It can be used with TCP. I expect performance won't be very good. –  Keith May 30 '11 at 6:25
    
Thanks for the answers guys. I think i'll stick with sshfs when outside home, but nfs when i'm in the lan. –  Tomas May 31 '11 at 20:44
1  
@Keith NFS is a file level protocol. iSCSI, AoE are block level protocols, but not NFS. –  user39351 May 17 '13 at 3:23
add comment

4 Answers

up vote 10 down vote accepted

If you use NFSv4 with sec=krb5p, then it is secure. (That means use Kerberos 5 for authentication, and encrypt the connection for privacy.) But if you use NFS v3 or NFS v4 with sys=system, then no, it's not secure at all.

There might also be some concern with exposing the kerberos and rpc ports to the internet at large, just in case of unknown vulnerabilities.

share|improve this answer
    
Thanks. Just one thing. Is that option configured in the server side? –  Tomas May 29 '11 at 21:43
1  
@Tomas: it is negotiated, with the server and client both having the option. If you want to limit to only secure connections, then definitely only list sec=krb5p on the export options. –  mattdm Aug 20 '11 at 23:47
add comment

SSHFS is indeed the way to go. I searched a lot for a network filesystem that I could use over the internet. I have a box in another location I use to store videos on. I have the location mounted on my home HTPC and have connections up for months. The speed is practically native to what you get on your upstream/downstream internet connection, the overhead of ssh is negligible. And the pros of encryption but also the use of public/private keys and ssh-agent for authentication are significant.

share|improve this answer
    
Welcome to Unix & Linux Stack Exchange! This is a questions and answers site, not a discussion forum. Your post does not answer the question, so it is likely to be removed. –  Gilles Jun 12 at 22:38
    
@Gilles It sort of answers the question, in that OP appears to be trying to decide between NFS and sshfs, and this answer tells OP his fears about sshfs are unfounded. –  derobert Jun 12 at 23:54
    
That said, if you can add some info about NFS's security /performance over the Internet, this would be a much stronger answer. –  derobert Jun 12 at 23:55
add comment

I don't know who some people are, but I don't agree with them at all. sshfs is about 99% of the speed of NFS (tested) and a lot more robust. It carries with it the ability of ssh to handle the flaky nature of internet traffic without dropping, that on NFS would have you hanging with stale file handles.

I've used sshfs to mount my home directory on my box in NYC from San Jose and stayed connected and working for 3 days continuous data movement without a hiccup.

Try it, you'll like it.

share|improve this answer
add comment

NFS itself is not generally considered secure - using the kerberos option as @matt suggests is one option, but your best bet if you have to use NFS is to use a secure VPN and run NFS over that - this way you at least protect the insecure filesystem from the Internet - ofcourse if someone breaches your VPN you're effectively wide open, but that would be the usual scenarion anyway.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.