Why the Sun 2 has a message “Love your country, but never trust its government”

> NFS ran in plaintext and used the sender’s IP address for authentication

and it still does

It was much worse than that.

Back when I was a summer intern at Sun in 1987, it was common knowledge among the engineers at Sun that NFS stood for "No File Security", and the rpc mount protocol would trust the client to tell the server its host name, which the server would look up in /etc/exports to decide how much to trust it.

So if you know that Scott McNealy's workstation's name was "doober" (which it was), and it gave permission to a server named "mama", then on any workstation you could type:

% hostname mama; mount doober:/usr /mnt; hostname `hostname`

And you'd have Scott McNealy's /usr file system mounted.

This also worked over the internet!

NFS used to be one of the most popular ways to break into machines on the 1990s Internet. Leendert van Doorn wrote a CLI for NFS that was modified with a bunch of different exploits and passed around among hackers. Everyone who attacked Unix systems in (say) 1995 had a copy of NFS shell.

I wrote one myself. Fun things: 'int getuid() { return 0; }' in the userland code was sufficient for authentication. And the mountd returned the root handle of the file system. When you presented that handle to nfsd it would happily serve you even when you are no longer in the exports table.