maxwell175 / ssnfs

Simple Secure Network File System - Coming Soon

SSNFS - A Simple, Secure Network File System

Why?

The reason I started this project is because currently, there is no network file transfer protocol that is:

• Secure
• Robust
• Easy to setup

For example, in the Linux world there is NFS, but it has no security what-so-ever (without any separate tunneling). In the Windows world, there is Samba. Things are a little better here, but it still has no traffic encryption (by default) and may not be trivial to set up.

The goal

This project's goal is to create a simple way to mount a directory located on a server to one or more clients using the most security conscientious way available.

Progress

• Read only mode (Completed)
• Read Write mode (Completed)
• Configuration (Completed)
• Managment interface (In Progress)

Building

First, clone the repository as well as the submodules: git clone --recursive https://github.com/MDTech-us-MAN/SSNFS.git

Or, if you already cloned the repository, but forgot to include --recursive, just run the following command in the repository directory: git submodule update --init --recursive

Before building, be sure to have Qt5 (qt5-default in Ubuntu) and libssl (libssl-dev in Ubuntu) already installed. For the client, you will also need libfuse2 (libfuse-dev in Ubuntu).

By default the PREFIX is set to /usr/local for release builds or the build directory for debug builds. If you would like to change this, simply add PREFIX=<new path> to the qmake line.

To build both client and server:

mkdir build
cd build
qmake ..
make
sudo make install

To build only server:

mkdir build-server
cd build-server
qmake "CONFIG+=server" ..
make
sudo make install

To build only client:

mkdir build-client
cd build-client
qmake "CONFIG+=client" ..
make
sudo make install

Usage

To set up the server, simply run the server executable with the --init option. This will start an interactive configuration system.

To access the server's web administration panel, just point your web browser to HTTPS port 2050 of the server.

To register a client with the server, run SSNFS-client register <Server Host>:<Server Port>.

Unfortunatly, a complete managment interface is not fully ready yet. It is currently activly being developed and should be ready soon. Until then, there may be some cases where you may need to edit the config.db using a SQLite3 capable editor.

On the client side, simply use the standard mount syntax: SSNFS-client <Server Host>:<Server Port>/<Share Name> <Mount Directory>

Contributing

Please let us know on Gitter what you are working on so we can better coordinate our efforts.

Coding style

This project uses the Google C++ Style Guide

Commit Message Template

Please set .git-commit-template.txt as your commit message template and follow the rules set forth therein. To do so, simply run the following command in the project root directory:

git config commit.template .git-commit-template.txt

Read this post for more info.

ssnfs's Issues

`readdir` on folders with a lot of items crashes both client and server.

Implement a basic web server to allow web administration.

The basic idea is to intercept HTTP requests where the server waits for HELLO.

Create computer registration system.

Create the process for registering a new computer to the user.

Improve Write operation performance.

Write performance is around 11MB/s, which is highly unsatisfactory.

Implement the server configuration.

Server config should be stored in a SQLite DB.

Process doesn't exit after file system is unmounted.

Fix crash when generating server certificate

Server crashes when generating certificate.

Environment:

• Ubuntu 18.04.1 LTS
• libssl1.0-dev version: 1.0.2n-1ubuntu5.1
• openssl1.0 version: 1.0.2n-1ubuntu5.1
• Qt version: 5.10.1

To reproduce run:
$ path/to/SSNFSd --init

Add check to make sure the target paths are within the allowed mount directory!

Before executing any of the requests make sure that the target path provided by the client doesn't have any gotchas such as an extra trip to the parent directory of the mount point, or worse the root of the actual server's file system.

Obviously, this shouldn't happen unless there is a serious client-side bug (or the client is actually a malicious attacker).

Design webpanel for managing the server.

Sometimes when a client abruptly disconnects, the server crashes.

/home/maxwell/Coding/SSNFS/SSNFSd/ssnfsworker.cpp:358 - Error! Invalid operation from client.
unknown:0 - QThread: Destroyed while thread is still running

Create an interactive initialization process.

An interactive server initialization system is urgently needed.

Tentatively, the following are the settings that it must set.

• Port number to listen on. (Settings table)
• Private key file path. (Settings table) - should offer to generate.
• Certificate file path. (Settings table) - should offer to generate.
• Web Panel install location. Should default to $PREFIX/etc/webpanel. (Settings table)
• Log location. stdout/stderr or an actual file. Granular controls by log category should be available only in webpanel.
• Add admin user.

Integrate PKCS#11 into server

Server private key needs to be protected in an HSM. To achieve this, PKCS#11 standard is required.
SoftHSM will be used as a soft implementation of an HSM.

Copying a directory with files of a large size sometimes bugs up the connection.

Tested with a 200GB video file directory. Started failing at around 20-40%.

Error on server side:

unknown:0 - The File Descriptor link in /proc increased in size between lstat() and readlink()! old size: 64  new size: 65  readlink result: QVector(/, D, a, t, a, D, r, i, v, e, s, /, S, t, o, r, e, s, /, M, a, i, n, -, P, C, /, T, e, s, t, D, i, 

Checking if file exists before trying to remove a file

While following the building process. On executing the post-merge script, I get the following error

mv: cannot stat 'SSNFSd/config.db': No such file or directory
rm: cannot remove 'SSNFSd/config.db.old': No such file or directory

Pasting file not working in KDE Dolphin.

After some cursory investigation, the main reason most likely is that there is no statfs callback on the client.

Fix poor performance.

The performance still has room to improve.

Implement logging throughout both the server and the client.

This will be done using the spdlog library.

Initial idea:

• Before the config is fully loaded, messages will be printed to console.
• Following that, the logging choices specified in the config should be used.