Synology NFS Server

Synology CS407e

Samba is too slow, AFP does not reconnect after network error.

Using NFS, tcp or udp, while playing HD contents on the server, and try to access the nfs volume, it blocks for a while.

Solution, create more nfsd daemon.

/usr/syno/etc/rc.d/S83nfsd.sh

#To create 16 nfs servers
/usr/sbin/nfsd 16

To see server loading

/proc/net/rpc/nfsd

th 16 261 2.256 2.056 3.144 1.404 3.564 3.820 1.556 2.408 1.696 14.924

16 threads, used the last thread 261 times.
2.256 seconds uses 10% of the 16 threads
2.056 seconds uses 20% of the 16 threads
...

nfsd privileged port

http://mars.netanya.ac.il/~unesco/cdrom/LDP/NFS/HTML_FORMAT/NFS-HOWTO-6.html

Another important thing is to ensure that nfsd checks that all it's requests comes from a privileged port. If it accepts requests from any old port on the client a user with no special privileges can run a program that's is easy to obtain over the Internet. It talks nfs protocol and will claim that the user is anyone the user wants to be. Spooky. The Linux nfsd does this check by default, on other OSes you have to enable this check yourself. This should be described in the nfsd man page for the OS.

Another thing. Never export a file system to 'localhost' or 127.0.0.1. Trust me.

新版的說
http://nfs.sourceforge.net/nfs-howto/ar01s06.html
The TCP ports 1-1024 are reserved for root's use (and therefore sometimes referred to as "secure ports") A non-root user cannot bind these ports. Adding the secure option to an /etc/exports means that it will only listed to requests coming from ports 1-1024 on the client, so that a malicious non-root user on the client cannot come along and open up a spoofed NFS dialogue on a non-reserved port. This option is set by default.

舊的版本說,只要相信從1024以下來的client,而且不要給localhost連線。這有點道理,如果相信從localhost來的1024以上的連線,可能是假造的。
但是應該只要做其中一項就好了吧,外部的連線不管是不是1024以下的都有可能會是假的。

不知道為什麼linux的實作還是這樣。

在mac上面mount_nfs要加上
-o resvport
Use a reserved socket port number. This is useful for mounting
servers that require clients to use a reserved port number on the
mistaken belief that this makes NFS more secure. (For the rare
case where the client has a trusted root account but untrustwor-
thy users and the network cables are in secure areas this does
help, but for normal desktop clients this does not apply.)

意思就是說這樣根本沒什麼用就對了。

如果沒有加這個的話,會出現 /Volumes/nfs: Permission Denied

或是在nfs server /etc/exports 加上 insecure

DKIM,Domainkey

Yahoo真的有在用。

 _domainkey.yahoo.com txt  "t=y\; o=~\; n=http://antispam.yahoo.com/domainkeys"

還不清楚他的格式,不過像我的。

netbsd._domainkey.netbsd.pfctl.info TXT "v=DKIM1\; g=*\; k=rsa\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWv8fdQDN1FUJJxeZ6NMdOy8tAEwuTEzpsk1wYfxtYFwz1hHPiuOhF/KJSR2gvR8JuVAC92sI7RupEmBafscJdcqwepb2IVV+4GCZMNUfDpWtmXcoLQ+DZabZvpdlo9xLnZ5nR/oXiM00DlUlS2wI6nrF0Zf44Ib8eCJAo1x/+JQIDAQAB"

DNS record的格式是

selector._domainkey.domain
selector是在dkim-milter裡面指定的,可以有很多不同的selector,簽名的時候會標記說是用哪個selector簽名的。

DKIM,DomainKeys,SPF

之前有寫過SPF
現在發現Yahoo喜歡檢查DKIM/DomainKeys,這兩個好像是不一樣的東西啦,DKIM據說是Yahoo跟Cisco弄出來的。

跟SPF不一樣的就是,他是用來對發出去的郵件做簽章,沒有簽章的就是垃圾郵件。
public key則是放再dns的txt欄位。

目前還不是很清楚怎麼弄。
也不知道有誰家的郵件有加這個,yahoo自己也沒有。而且每封信都要驗證太麻煩了吧。那乾脆對身分驗證好了ksc91u@ksc91u.info 變成自己放一個txt ksc91u.at.ksc91u.info到dns去。