Exporting GuardPoints over NFS

Warning

• CTE-U cannot guard a sub-directory of an exported NFS share directory. The guarded path must be the same as the NFS exported path.

• Use of process sets or signature sets is not supported

Note

• For CTE-U v10.3.0 and subsequent versions, user sets are supported. See Creating User Sets for more information.

Prerequisites

CTE-U does not support accessing processes with the export scenario. Therefore, you must either disable the authenticator check or add the NFS process as an authenticator.

• To disable the authenticator check, type:

  voradmin secfs config uid_uid_search 0

  Copy

• To add the NFS process as an authenticator, add the following in the CipherTrust Manager > Client Settings field:

  |authenticator|/usr/sbin/rpc.mountd
  |authenticator|/usr/sbin/rpc.nfsd
  |authenticator|/usr/sbin/exportfs

  Copy

Setup and Configuration

To setup and configure your NFS server so that you can export GuardPoints:

1. Make sure that CTE-U is started before the NFS server is started:

   vi /usr/lib/systemd/system/nfs-server.service

   Copy

   Response

   network-online.target local-fs.target secfs-fuse.service

   Copy

2. Create your GuardPoints on your NFS server.

3. Verify that the /etc/exports file contains the following:

   /guardpoint/path <nfs_server_IP>(rw,sync,fsid=3,no_root_squash)

   Copy

4. Verify that secfs_fuse was started before NFSD:

   ps -ef |grep secfs; ps -ef |grep nfsd nfsd pid

   Copy
   

   Note

   The GuardPoint PID is valid as long as the NFS daemon is not restarted.

5. If secfs_fuse was not started before NFSD, or if you are unable to verify it, restart the NFS server:

   service nfs-server restart

   Copy

6. Mount the client:

   mount -o lookupcache=none

   Copy
   

   Note

   When mounting as a non-root user with NFS mount (guarded in NFS server):

   • Specify only the GID for the non-root user in the user set configuration in the policy.

   • Alternatively, include the root user as part of the user set configuration in the policy, but limit root user permissions. The following allows the root user to mount NFS, but they cannot read the actual data.

     • Action = d_rd-att

     • Effect = permit,audit