It seems that tcpwrappers does not honor netgroups. As this was noted in a different unrelated bug, I'm opening this one: https://bugzilla.redhat.com/showbug.cgi?id=440114#c8

It seems that netgroups are not working; if I put in my hosts.allow file

mountd: hostname - or - mountd: ip-address

then I can mount, but if I have a netgroup, I can't... for instance

mountd: @selectedhosts

Can you confirm this behaviour?

A security flaw was found in the way nfs-utils performed authentication of an incoming request, when an IP based authentication mechanism was used and certain file systems were exported to either to a netgroup or a wildcard (e.g. .my.domain), and some file systems (either the same or different to the first set) were exported to specific hosts, IP addresses, or a subnet. A remote attacker, able to create global DNS entries could use this flaw to access above listed, exported file systems.

References: [1] https://bugzilla.novell.com/showbug.cgi?id=701702 [2] http://www.openwall.com/lists/oss-security/2011/06/27/7 (CVE Request)

Relevant upstream patch: [3] http://marc.info/?l=linux-nfs&m=130875695821953&w=2