Feb 27

NFS over the Internet?

Category: Linux   — Published by tengo on February 27, 2009 at 4:28 am

I recently had the idea of trying to use a NFS (Network File System) share over the network and did a bit of research about it. Here are my results:

As became obvious, the idea is not that new, with threads dating back to the 80s (here and here). The most important concern seems to be security. Standard NFS uses UDP communication, which is more prone to sniffing and attacks than TCP appears to be (which NFS can use alternatively).

So the general idea of using NFS over a WAN network isn't doomed at all, but you'll need to take measures to secure your communication. One way to do so seems to be to tunnel NFS over SSH. Just like with secured FTP communication, the SSH shell here serves as a secured path on which NFS can work in its standard behavior. Effectively a Virtual Private Network. So another way of tunneling NFS would be configuring NFS over a CIPE-VPN. How reliable and practical these solutions are, I can't tell yet.

Alternatives

SSHFS

As it appears, a first reflex from many users when asked about the idea of NFS over WAN is to present alternatives and advising to not go this path.What I read many times is the call for sshfs (wikipedia, official). Effectively, sshfs is a secure shell as tunnel AND an underlying FTP subsystem on the remote system, similar to the mentioned secured FTP versions. A solution that does this two-step in one is shfs. Might work well, especially as it is based on the FUSE system, which allows userspace drive mounts on quite a number of systems (except Win32, btw...), but I am doubtful in terms of how fully filesystem operations are implemented in sshfs. FTP has a few shortcomings, for example if you need to keep creation/modification timestamps when moving files. Yes, FTP can do it but not all FTP-Servers support it, have it switched on or sites do not allow it. So keep an eye on your dates when using sshfs and tell me if sshfs inherited this FTP problem through the underlying system.

There are many such solutions out there, among them FTPFS, LUFS, ... - all with their own platform hurdles, security flaws etc.

Local Client App + Some Service

In case you don't want or can't setup a mount-on-boot remote mount point on your system, using some software that does the mount for you and connects to a remote service seems to be a good solution, especially for more novice users. There are many such apps out there, for example Webdrive, Jungledrive etc. Effectively they work just like a FTP client but do so by adding a virtual local drive (mount a virtual drive in userspace), exactly what FUSE does, but with a GUI. The question here is: who is your storage provider? Will you run your own secure FTP site? Or connect to Amazon S3, Microsoft's Skydrive (does it allow FTP??) or even the ancient Apple iDrive - all of these have some limitations and more often even security flaws arising from their design. A good storage provider isn't on the horizon, yet. (And don't you dare to tell me about Google's attempt with GDrive/Google Drive!!)

What else? Enough for today.