24

I want to connect to my home server from work using NFS. I tried sshfs but some people say it's not as reliable as NFS.

I know sshfs traffic is encrypted. But what about NFS? Can someone sniff my traffic and view the files I'm copying?

I'm using NFSv4 in my LAN and it works great.

  • Who are the “some people”, and what exactly do they say? – Gilles May 29 '11 at 21:43
  • NFS is a block level protocol and is sensitive to latency. It's usually used with UDP so you may have firewall issues. It can be used with TCP. I expect performance won't be very good. – Keith May 30 '11 at 6:25
  • Thanks for the answers guys. I think i'll stick with sshfs when outside home, but nfs when i'm in the lan. – Tomas May 31 '11 at 20:44
  • 3
    @Keith NFS is a file level protocol. iSCSI, AoE are block level protocols, but not NFS. – user39351 May 17 '13 at 3:23
  • 2
    SSHFS is indeed the way to go. The speed is practically native to what you get on your upstream/downstream internet connection, the overhead of ssh is negligible. And the pros of encryption but also the use of public/private keys and ssh-agent for authentication are significant. – Robin van Leeuwen Jun 12 '14 at 19:35
21

If you use NFSv4 with sec=krb5p, then it is secure. (That means use Kerberos 5 for authentication, and encrypt the connection for privacy.) But if you use NFS v3 or NFS v4 with sys=system, then no, it's not secure at all.

There might also be some concern with exposing the kerberos and rpc ports to the internet at large, just in case of unknown vulnerabilities.

  • Thanks. Just one thing. Is that option configured in the server side? – Tomas May 29 '11 at 21:43
  • 1
    @Tomas: it is negotiated, with the server and client both having the option. If you want to limit to only secure connections, then definitely only list sec=krb5p on the export options. – mattdm Aug 20 '11 at 23:47
  • Some concern is an understatement. Who is insane enough to use NFs in the Internet at large without tunneling it? – Rui F Ribeiro Oct 3 '17 at 18:53
14

NFS itself is not generally considered secure - using the kerberos option as @matt suggests is one option, but your best bet if you have to use NFS is to use a secure VPN and run NFS over that - this way you at least protect the insecure filesystem from the Internet - ofcourse if someone breaches your VPN you're effectively wide open, but that would be the usual scenarion anyway.

2

I don't know who some people are, but I don't agree with them at all. sshfs is about 99% of the speed of NFS (tested) and a lot more robust. It carries with it the ability of ssh to handle the flaky nature of internet traffic without dropping, that on NFS would have you hanging with stale file handles.

I've used sshfs to mount my home directory on my box in NYC from San Jose and stayed connected and working for 3 days continuous data movement without a hiccup.

Try it, you'll like it.

  • 4
    SSHFS does have some important downsides. Off the top of my head, there's no support for file locking. This can get you into trouble in a multi-user environment -- though you'll probably be okay if you're just accessing your home directory. SSHFS is also not very tolerant of flakey network connections. Which isn't to say NFS likes being disconnected either, but seems better able to recover without having to completely unmount the remote filesystem. – Trevor Johns Nov 14 '15 at 18:47
  • 1
    The speed depends. I'm running OpenWRT on an Archer C7, and NFS is five times faster than sshfs. – Sparhawk May 15 '16 at 13:13
  • 1
    "The speed depends. I'm running OpenWRT on an Archer C7" that is because sshfs is CPU-bound, to an extent, the encryption is done on the CPU. So, if you are connecting workstation to workstation, it should be fine ... routers with MIPS or ARM is a no-go. – thecarpy Oct 3 '17 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.