34

I want to connect to my home server from work using NFS. I tried sshfs but some people say it's not as reliable as NFS.

I know sshfs traffic is encrypted. But what about NFS? Can someone sniff my traffic and view the files I'm copying?

I'm using NFSv4 in my LAN and it works great.

Improve this question
5
  • Who are the “some people”, and what exactly do they say?
    – Gilles 'SO- stop being evil'
    May 29, 2011 at 21:43
  • NFS is a block level protocol and is sensitive to latency. It's usually used with UDP so you may have firewall issues. It can be used with TCP. I expect performance won't be very good.
    – Keith
    May 30, 2011 at 6:25
  • Thanks for the answers guys. I think i'll stick with sshfs when outside home, but nfs when i'm in the lan.
    – Tomas
    May 31, 2011 at 20:44
  • 4
    @Keith NFS is a file level protocol. iSCSI, AoE are block level protocols, but not NFS.
    – user39351
    May 17, 2013 at 3:23
  • 2
    SSHFS is indeed the way to go. The speed is practically native to what you get on your upstream/downstream internet connection, the overhead of ssh is negligible. And the pros of encryption but also the use of public/private keys and ssh-agent for authentication are significant.
    – Robin van Leeuwen
    Jun 12, 2014 at 19:35

3 Answers 3

Reset to default
28

If you use NFSv4 with sec=krb5p, then it is secure. (That means use Kerberos 5 for authentication, and encrypt the connection for privacy.) But if you use NFS v3 or NFS v4 with sys=system, then no, it's not secure at all.

There might also be some concern with exposing the kerberos and rpc ports to the internet at large, just in case of unknown vulnerabilities.

Improve this answer
3
  • Thanks. Just one thing. Is that option configured in the server side?
    – Tomas
    May 29, 2011 at 21:43
  • 1
    @Tomas: it is negotiated, with the server and client both having the option. If you want to limit to only secure connections, then definitely only list sec=krb5p on the export options.
    – mattdm
    Aug 20, 2011 at 23:47
  • 1
    Some concern is an understatement. Who is insane enough to use NFs in the Internet at large without tunneling it?
    – Rui F Ribeiro
    Oct 3, 2017 at 18:53
17

NFS itself is not generally considered secure - using the kerberos option as @matt suggests is one option, but your best bet if you have to use NFS is to use a secure VPN and run NFS over that - this way you at least protect the insecure filesystem from the Internet - ofcourse if someone breaches your VPN you're effectively wide open, but that would be the usual scenarion anyway.

Improve this answer
7

I don't know who some people are, but I don't agree with them at all. sshfs is about 99% of the speed of NFS (tested) and a lot more robust. It carries with it the ability of ssh to handle the flaky nature of internet traffic without dropping, that on NFS would have you hanging with stale file handles.

I've used sshfs to mount my home directory on my box in NYC from San Jose and stayed connected and working for 3 days continuous data movement without a hiccup.

Try it, you'll like it.

Improve this answer
5
  • 7
    SSHFS does have some important downsides. Off the top of my head, there's no support for file locking. This can get you into trouble in a multi-user environment -- though you'll probably be okay if you're just accessing your home directory. SSHFS is also not very tolerant of flakey network connections. Which isn't to say NFS likes being disconnected either, but seems better able to recover without having to completely unmount the remote filesystem.
    – Trevor Johns
    Nov 14, 2015 at 18:47
  • 2
    The speed depends. I'm running OpenWRT on an Archer C7, and NFS is five times faster than sshfs.
    – Sparhawk
    May 15, 2016 at 13:13
  • 3
    "The speed depends. I'm running OpenWRT on an Archer C7" that is because sshfs is CPU-bound, to an extent, the encryption is done on the CPU. So, if you are connecting workstation to workstation, it should be fine ... routers with MIPS or ARM is a no-go.
    – thecarpy
    Oct 3, 2017 at 17:54
  • I use wireguard+nfs instead of sshfs and its very stable too.
    – Akhil
    Oct 25, 2022 at 4:35
  • We had to replace SSHFS with NFS for performance reasons. SSHFS didn't scale well for increasing number of client machines. We had significant performance gains after the switch to NFS. SSHFS was also very susceptible to network issues. I personally love and use SSHFS at home and for my individual needs. It is very simple to setup and maintain and it is sufficient for simple file transfer.
    – oᴉɹǝɥɔ
    Apr 14 at 21:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .