NetworkFileSystem:Security

lastmod 2026-02-09created 2026-02-093 edits

Security verification checklist

Linux security configuration

Check firewall status

# UFW 상태 상세 확인 / Check UFW status
sudo ufw status verbose

# 열린 포트 최소화 확인 / Verify minimal open ports
sudo ss -tulnp

Expected result: Only 22/tcp (SSH) and 2049/tcp (NFS) should be allowed. If any other unnecessary ports are open, block them immediately.

Check NFS exports

# 현재 내보내기 목록 확인 / Verify current exports
sudo exportfs -v

# NFS 서버 상태 확인 / Check NFS server status
sudo systemctl status nfs-server

Things to check:

Check that root_squash or all_squash is applied
Check that IP restrictions are set correctly
Check that sec=sys or sec=krb5p is specified

AppArmor status

sudo aa-status

Expected result: All profiles should be in enforce mode. If any profile is in complain mode, switch it to enforce:

# complain → enforce 전환 / Switch to enforce mode
sudo aa-enforce /etc/apparmor.d/<profile_name>

Fail2Ban status

# 전체 상태 확인 / Check overall status
sudo fail2ban-client status

# SSH jail 상세 확인 / Check SSH jail details
sudo fail2ban-client status sshd

Expected result: The sshd jail should be enabled, and the list of banned IPs should be managed normally.

Check audit logs

# NFS 설정 변경 감사 / Audit NFS config changes
sudo ausearch -k nfs_exports -ts recent

# 사용자/그룹 변경 감사 / Audit identity changes
sudo ausearch -k identity -ts recent

# sudoers 변경 감사 / Audit sudoers changes
sudo ausearch -k sudoers -ts recent

# 파일 삭제 감사 / Audit file deletions
sudo ausearch -k delete -ts recent

Check kernel security parameters

# 주요 sysctl 값 확인 / Verify key sysctl values
sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.tcp_syncookies
sysctl kernel.randomize_va_space
sysctl kernel.dmesg_restrict
sysctl kernel.kptr_restrict
sysctl net.ipv4.ip_forward

Parameter	Expected value	Meaning
net.ipv4.conf.all.rp_filter	1	IP spoofing protection enabled
net.ipv4.tcp_syncookies	1	SYN flood protection enabled
kernel.randomize_va_space	2	Full ASLR
kernel.dmesg_restrict	1	Blocks dmesg access for regular users
kernel.kptr_restrict	2	Hides kernel pointer addresses
net.ipv4.ip_forward	0	IP forwarding disabled

Check NFS client mounts

# 마운트 옵션 확인 / Verify mount options
mount | grep nfs4

# noexec, nosuid, nodev 적용 여부 확인 / Check security mount options
cat /proc/mounts | grep nfs4

Expected result: The mount options should include all of noexec, nosuid, and nodev.

Check SSH configuration

# SSH 설정 테스트 / Test SSH configuration
sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication|pubkeyauthentication|x11forwarding|maxauthtries|allowusers'

Item	Expected value
permitrootlogin	no
passwordauthentication	no
pubkeyauthentication	yes
x11forwarding	no
maxauthtries	3

Overall security architecture summary

Security layer	Components	Details
1. Network	UFW + NFSv4 Only	Per-IP access restriction, only port 2049 open
2. Authentication \|\| sec=sys / sec=krb5p	all_squash + dedicated NFS user (krb5p if Kerberos is available)
3. Permissions	root_squash / all_squash	Dedicated NFS user, minimal directory permissions (770)
4. Mount	noexec, nosuid, nodev	Blocks client-side execution/privilege escalation
5. Auditing	auditd	Tracks /etc/exports changes, monitors user changes
6. System	sysctl + AppArmor + Fail2Ban	Kernel hardening, MAC, brute-force protection
7. SSH	Key authentication only	Passwords blocked, algorithms restricted, users restricted

Periodic check script

Register the script below with cron to check the security status periodically.

#!/bin/bash
# security_check.sh - 보안 상태 정기 점검 / Periodic security check

echo "========== Security Check Report: $(date) =========="

echo ""
echo "[1] UFW Status"
sudo ufw status | head -20

echo ""
echo "[2] Listening Ports"
sudo ss -tulnp | grep LISTEN

echo ""
echo "[3] NFS Exports"
sudo exportfs -v

echo ""
echo "[4] Fail2Ban Banned IPs"
sudo fail2ban-client status sshd 2>/dev/null | grep "Banned"

echo ""
echo "[5] AppArmor Profiles"
sudo aa-status 2>/dev/null | head -5

echo ""
echo "[6] Recent Auth Failures"
sudo grep "Failed password" /var/log/auth.log 2>/dev/null | tail -5

echo ""
echo "[7] NFS Mount Options"
mount | grep nfs4

echo ""
echo "[8] Critical sysctl Values"
for param in net.ipv4.ip_forward kernel.randomize_va_space kernel.dmesg_restrict; do
    echo "  $param = $(sysctl -n $param)"
done

echo ""
echo "========== Check Complete =========="

# 실행 권한 부여 및 cron 등록 / Make executable and add to cron
chmod +x /usr/local/bin/security_check.sh
echo "0 6 * * 1 root /usr/local/bin/security_check.sh >> /var/log/security_check.log 2>&1" | sudo tee /etc/cron.d/security-check