documentation_complete: true

title: 'Mount Remote Filesystems with Restrictive Options'

description: |-
    Edit the file <tt>/etc/fstab</tt>. For each filesystem whose type
    (column 3) is <tt>nfs</tt> or <tt>nfs4</tt>, add the text
    <tt>,nodev,nosuid</tt> to the list of mount options in column 4. If
    appropriate, also add <tt>,noexec</tt>.
    <br /><br />
    See the section titled "Restrict Partition Mount Options" for a description of
    the effects of these options. In general, execution of files mounted via NFS
    should be considered risky because of the possibility that an adversary could
    intercept the request and substitute a malicious file. Allowing setuid files to
    be executed from remote servers is particularly risky, both for this reason and
    because it requires the clients to extend root-level trust to the NFS
    server.
