Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Port 2049 (NFS): what it is, how it is attacked and how to secure it

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 9 November 2026.

In one sentence: Port 2049 is where the Network File System shares folders between Linux and Unix machines, and its default trust model assumes every machine on the network tells the truth.

What runs on this port

NFS lets one machine share a folder so that other machines can mount it as if it were local. It is common on Linux file servers, NAS devices, backup systems, virtual machine storage and web server clusters. NFS listens on TCP and UDP port 2049. Older versions (NFSv3) also depend on rpcbind on port 111 and on helper services such as mountd on other ports. Newer NFSv4 does not need the old MOUNT protocol. Red Hat says removing it was an important security feature, because the way it handled file handles was a risk.

Why attackers look for it

Internet-wide scanners record hosts that answer on 2049 and 111. An open NFS server can be asked which folders it exports and to which machines. A share that is open to a wide range of addresses, or to everyone, is a quick win for an attacker. NFS shares often hold home directories, backups and application data, so the prize is bigger than the port suggests.

How it gets attacked

The risks are mostly configuration, not a single bug.

  • Trusting the client’s word. The traditional login method, AUTH_SYS, relies on the client to state a user’s ID. Red Hat says a malicious or misconfigured client can easily get this wrong and allow a user access to files that it should not.
  • Root squashing turned off. By default NFS uses root squashing, which maps the client’s root user to the unprivileged user “nobody”. Red Hat says that, if possible, you should never disable it. The option no_root_squash hands a client’s root user full power over the shared files.
  • Wide export rules. Red Hat says wildcards should be used sparingly, because their scope can cover more systems than intended.
  • Name tricks. If an attacker controls the DNS server the NFS server relies on, a trusted hostname can be pointed at a rogue machine, which is then allowed to mount the share.
  • Exposed helper services. rpcbind has had its own flaw, CVE-2017-8779, described in the port 111 entry.

Who it affects and how badly

  • Sole trader to 10 staff. A NAS with NFS switched on for a media app is typical. Worst case: personal or client files exposed.
  • 10 to 50 and 50 to 250 (manufacturing, SaaS start-ups, MSPs). NFS holds shared build files, backups and customer data. Worst case: someone with a foothold on one Linux machine reads or changes everything on the share.
  • Regulated (healthcare, fintech, councils). Exposed shares holding personal data become a breach to assess under UK GDPR, EU GDPR or the Armenian Personal Data Protection Law, with downtime and lost trust as well.

What we check on a test

  • Whether 2049 and 111 answer from outside the network.
  • Which folders are exported, and to which addresses or ranges.
  • Whether the server uses AUTH_SYS or Kerberos (sec=krb5, krb5i, krb5p).
  • Whether root squashing is on, and whether any export lets a client’s root act as root.
  • Whether shares are mounted read-only where they can be, and whether the client mounts forbid running programs from them.
  • Whether the server holds more than the share needs, such as home directories.

The UK angle

Cyber Essentials (NCSC requirements, version 3.3, April 2026) requires you to block unauthenticated inbound connections by default, to document each inbound rule with its business need, and to remove or disable unnecessary network services. An NFS server open to the internet breaks all three. Cyber Essentials does not demand Kerberos on NFS, but its secure configuration control expects only the services a device needs.

Diagram: who the server believes

Before: AUTH_SYS Client NFS server “I am user 1001” Server cannot check the claim After: Kerberos Client NFS server signed ticket Server verifies who the user is

Worked example (illustration only)

A 30-person design studio shares project folders from a Linux NAS using NFS, exported to the whole office subnet with root squashing off because “it made the backup job easier”. A contractor’s laptop on the guest wifi is on the same subnet. The risk is that anyone with root on any machine in that range can read or change every project file. The studio’s cost is client trust and a rebuild of files if they are changed. The fix: limit the export to named machines, turn root squashing back on, move the guest wifi to its own network and use Kerberos for the share.

How to check whether yours is exposed

  1. Look in your firewall and router for inbound TCP or UDP 2049 and 111.
  2. On a Linux server you own, review the export list (the /etc/exports file) with someone who understands it.
  3. Check your asset list for NAS devices that offer NFS.
  4. Run the free scan against your own public address. Test only what you own or are authorised to test.

How to secure it

  1. Never expose 2049 or 111 to the internet. Allow only named internal clients.
  2. Use NFSv4 with Kerberos (sec=krb5, or krb5i for integrity, or krb5p to also encrypt). Red Hat says with Kerberos the server does not depend on the client to say who the user is.
  3. Keep root squashing on (root_squash). Consider all_squash for read-only exports.
  4. Export only to named hosts. Avoid wildcards.
  5. Export read-only where writing is not needed.
  6. Restrict rpcbind with firewall rules or TCP wrappers.
  7. Patch the NFS and RPC packages.
  8. Keep DNS trustworthy, since export rules by hostname rely on it.

FAQ

Is NFS encrypted? Not by default. Red Hat lists sys as no cryptographic protection and the default. Kerberos options add authentication, integrity or privacy.

What is root squashing? A default setting that treats a client’s root user as the unprivileged user “nobody” on the server.

Do I need port 111 for NFSv4? Older NFS versions use rpcbind. See the port 111 entry for how to restrict it.

Related terms

port-111-rpcbind, port-445-smb, how-privilege-escalation-works, kerberos-authentication, cyber-essentials, patch-management, port-135-msrpc

More in the ports and protocols hub.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. See our penetration testing service and start with the free web vulnerability scan.