Re: Patch to mount_nfs to make NFSMNT_RESVPORT default
Re: Patch to mount_nfs to make NFSMNT_RESVPORT default
- Subject: Re: Patch to mount_nfs to make NFSMNT_RESVPORT default
- From: Andrew Gallatin <email@hidden>
- Date: Thu, 12 May 2005 16:04:46 -0400 (EDT)
Mike Mackovitch writes:
> On Thu, May 12, 2005 at 10:49:21AM -0400, Craig Rodrigues wrote:
> >
> > Can someone comment on the attached patch?
> > This patch makes NFSMNT_RESVPORT a default
> > option for mount_nfs, which greatly
> > improves interoperability with Linux
> > and FreeBSD NFS servers.
>
> Improving interoperability is a good thing.
> Unfortunately, this patch alone isn't a good answer.
>
> 1) All non-root NFS mount attempts would now fail.
>
> 2) The maximum number of NFS mounts would now be limited
> by the limited number of "reserved ports".
>
> Also, I would like to point out that the requirement that
> NFS connections come from reserved ports doesn't actually
> improve security... it just limits interoperability.
AFAIK, the problem is really Apple / Linux. FreeBSD and Solaris don't
require reserved ports by default. However, there are a *lot* of
Linux NFS servers out there (no matter how much some of us would like
to replace them.. ;)
Craig's first patch to make automount use reserved ports shouldn't
cause problems, and would save tons of man hours from poor
transplanted unix admins who are astonished that any unix could
fail to use a reserved port for automount. That was the last
thing I looked for. It took a tcpdump on the server for me to realize
what was happening.
IMHO, if there are really people who have more than a few hundred
automounts *at once*, and who are dealing with non-linux servers which
permit mount requests from non-reserved ports, then you can make an
argument to automount to revert to the current, non-interoperable
behaviour.
Drew
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden