NFS

The Network File System (NFS) is a distributed file-system protocol originally developed by Sun Microsystems. NFSv4 is specified in RFC 7530 (March 2015; obsoleted by RFC 8881 for NFSv4.1); earlier versions trace back to RFC 1094 (NFSv2) and RFC 1813 (NFSv3). NFS lets a client mount a remote directory and operate on it with ordinary file semantics — which also makes it a reliable source of misconfiguration-driven compromise on internal assessments.

All NFS versions use TCP/UDP port 2049 for data transfer. NFSv1–v3 additionally depended on the portmapper (rpcbind) service on port 111 to locate the mount and lock daemons; NFSv4 folded mounting and locking into the core protocol, removing the portmapper requirement.

Enumeration and mounting

# List exported shares on a server (queries the mount daemon /
# NFSv4 pseudo-root).
showmount -e $SERVER_IP
 
# Mount a share locally. The -nolock flag disables lockd,
# which is frequently filtered or broken across NAT.
sudo mount -t nfs ${SERVER_IP}:${SHARE_PATH} $LOCAL_MOUNT_DIR -nolock
 
# Force-unmount an unresponsive share (e.g. server went away).
sudo umount -f $LOCAL_MOUNT_DIR

The local mount directory should exist and be owned by root.

Root squashing

Files created on an NFS share carry the client-side UID/GID of the creating process — the server stores them verbatim and interprets ownership numerically. By default, NFS applies root squashing: requests arriving with UID 0 are mapped to the anonymous nobody user, so a root user on the client does not get root on the share.

no_root_squash in /etc/exports disables this mapping. That flag is a classic privesc primitive:

1. Attacker controls a machine that can mount the share as root (or compromises any host that can).
2. Attacker drops a binary onto the share with the SUID bit set and owner UID 0.
3. On any system where the share is mounted, executing that binary yields an euid 0 shell — because the file’s numeric UID 0 is honored by the mounting kernel.

The defensive counterpart: audit /etc/exports for no_root_squash, world-writable exports (rw,no_root_squash combined with *), and overly broad network ACLs; prefer NFSv4 with Kerberos (sec=krb5p) on untrusted networks, since bare NFSv3 authenticates hosts, not users.

Security relevance

• Enumeration — showmount -e and rpcbind (port 111) leaks are standard findings; nmap ships nfs-ls, nfs-showmount, and nfs-statfs NSE scripts.
• UID spoofing — NFSv3 trusts the client’s claimed UID; any local user can create an account with a target UID and read matching files on the share.
• Cleartext — Without Kerberos or a tunnel, NFS traffic is unencrypted and unauthenticated at the RPC layer.

Sources

• RFC 7530 — Network File System (NFS) Version 4 Protocol
• RFC 1813 — NFS Version 3 Protocol Specification

See also

• nmap
• ftp — another legacy cleartext file-transfer protocol
• unix-permissions