Re: regarding support of NFS versions (Re: Changing NGROUPS_MAX to 1024?)

[Matthias Petermann <mp%petermann-it.de@localhost>]

Hello,

On 4/20/26 08:41, od2uvb%0w.se@localhost wrote:
> To allow a compromise of a single unit attached to a "protected network"
> to make most of the data accessible? It makes sense, when the value of
> the data is so low that no attacker would ever care, or when the network
> is really small and under total control.
> This excludes any large/heterogeneous installation with nontrivial data.
>
> (yes, adding Kerberos to NFSv3 would improve this, but would leave its

> other limitations in place)


Hi,

I’m currently running a bit of NFS again on NetBSD for simple private 
use cases in my now Windows-free home network. The setup is fairly 
typical: a NetBSD server exporting via NFSv3, with a few Linux clients.

The security concerns you mentioned apply quite directly here. Even in a 
“trusted” LAN, the implicit trust model of NFSv3 feels increasingly out 
of place, especially once the network is no longer trivial in size or 
composition.

What I’m currently considering is to move the trust boundary away from 
the LAN itself and instead enforce it via a WireGuard overlay. 
Concretely, all clients (even those on the local network) would access 
the NFS server exclusively through WireGuard.

This would allow me to:

- assign stable, server-controlled IP addresses to each client within 
the WireGuard network
- restrict exports based on those addresses, effectively tightening 
host-level access control
- differentiate read/write permissions per client in a more controlled way
- avoid relying on the ambient trust of the LAN

It’s still a fairly simple model, but it at least contains the blast 
radius: a compromised LAN node would not automatically gain NFS access 
unless it also holds valid WireGuard credentials.

I haven’t pushed the idea much further yet, but at the moment it seems 
like a reasonable compromise between keeping NFSv3 for its simplicity 
and mitigating its weakest security properties without introducing 
significantly more complex infrastructure.

Curious if others have taken a similar approach or see obvious pitfalls.

Best regards
Matthias

--
Für alle, die digitale Systeme verstehen und gestalten wollen:
jede Woche neue Beiträge zu Architektur, Souveränität und Systemdesign.
👉 https://www.petermann-digital.de/blog