Bug 71222 - RFE: an option to lokkit to set up allowing of mounting nfs shares from servers
RFE: an option to lokkit to set up allowing of mounting nfs shares from servers
Status: CLOSED DEFERRED
Product: Red Hat Linux
Classification: Retired
Component: gnome-lokkit (Show other bugs)
7.3
All Linux
medium Severity medium
: ---
: ---
Assigned To: Bill Nottingham
Ben Levenson
: FutureFeature
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2002-08-10 07:37 EDT by Thomas Vander Stichele
Modified: 2014-03-16 22:29 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2002-08-12 18:55:37 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Thomas Vander Stichele 2002-08-10 07:37:55 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 Galeon/1.2.5 (X11; Linux i686; U;) Gecko/20020606

Description of problem:
Since, when trying to mount an nfs share, the mountd daemon on the server
chooses a random udp port number which the client needs to allow access to, the
default ipchains configuration in lokkit prevents the user from mounting nfs shares.

A simple solution would be to allow lokkit to select nfs servers, and open up
those udp ports from that server.  This is a lot less a security risk than the
consensus I read in mailing list archives and on newsgroups, which tells people
to turn ipchains off completely for mounting nfs shares.

I added to /etc/sysconfig/ipchains the following line
-A input -s 192.168.1.3 -d 0/0 0:1023 -p udp -j ACCEPT

right before this line put in by lokkit :
-A input -p udp -s 0/0 -d 0/0 0:1023 -j REJECT

This allows my machine to mount nfs shares served by the server at 192.168.1.3.

I suspect adding this to lokkit should be very simple, hopefully it'll be doable
before the next (7.4/8.0) release ;)


Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. run lokkit and set up a default firewall
2. activate ipchains (service ipchains start)
3.  try to mount an nfs share
	

Actual Results:  got an RPC: Timed out error after some time


Expected Results:  it should work

Additional info:

This is an enhancement proposal to lokkit.  Adding the option of selecting known
nfs servers and punching them through the firewall rules would be a good feature
as this seems to confuse a whole lot of people out there.
Comment 1 Mike A. Harris 2002-08-10 14:19:33 EDT
Not an ipchains issue.  Reassigning to gnome-lokkit
Comment 2 Bill Nottingham 2002-08-12 16:40:38 EDT
Won't be done for this release; we really aren't in a position to change th UI
at this point.

*** This bug has been marked as a duplicate of 52110 ***
Comment 3 Thomas Vander Stichele 2002-08-12 17:34:48 EDT
Hm, can I get some more feedback on this ? You marked this bug as a duplicate of
another bug, which was filed "not doable".  First of all, I think it's very much
doable, as I just proposed.  Second, judging from the amount of posts on it on
dejanews and other places, it's a very real issue, which is getting "fixed" by
turning off iptables.  Third, I can understand that it might be too late to
change the UI (even though the impact is minimal) for the next release, but AT
LEAST consider it for the release after that.  People will thank you ;)
Comment 4 Bill Nottingham 2002-08-12 18:57:14 EDT
Hm, OK.

Note You need to log in before you can comment on or make changes to this bug.