NFS - Revision history

Leo at 00:18, 25 April 2022

2022-04-25T00:18:18Z

← Older revision		Revision as of 00:18, 25 April 2022
Line 83:		Line 83:
	\|-		\|-
	\|<code>no_root_squash</code>		\|<code>no_root_squash</code>
	\|Squashing is the act of the NFS server converting files written as root on a remote system to nobody on the NFS server. Essentially, it converts UID and GID 0 to 65534 which typically maps to <code>nobody</code> or <code>nfsnobody</code>. This prevents a remote system from having root level permissions on the filesystem. The default is to squash.		\|Squashing is the act of the NFS server converting files written as root on a remote system to nobody on the NFS server. Essentially, it converts UID and GID 0 to 65534 which typically maps to <code>nobody</code> or <code>nfsnobody</code>. This prevents a remote system from having root level permissions on the filesystem. Operations that changes file permissions will fail with 'Operation not permitted'. The default is to squash.
	By setting no root squashing, you allow files on the remote system written by root to appear as root.		By setting no root squashing, you allow files on the remote system written by root to appear as root or have remote systems be able to change file ownerships.
	\|-		\|-
	\|<code>no_subtree_check</code>		\|<code>no_subtree_check</code>
Line 212:		Line 212:
	When trying to mount an export, I get this error:		When trying to mount an export, I get this error:

	mount.nfs: mounting bnas:surveillance/events/v2 failed, reason given by server: No such file or directory		{{Highlight
			\| code = mount.nfs: mounting bnas:surveillance/events/v2 failed, reason given by server: No such file or directory
			\| lang = text
			}}

	/surveillance/events is a ZFS dataset.		<code>/surveillance/events</code> is a ZFS dataset. On the server, <code>/etc/exports</code> has:

	/~~etc~~/~~exports has:~~		{{Highlight
			\| code = /surveillance 10.1.2.0/24(rw,no_subtree_check,no_root_squash,async,crossmnt)
			\| lang = text
			}}

	~~/surveillance 10.1.2.0/24(rw~~,~~no_subtree_check,no_root_squash,async,crossmnt)~~		When I try to mount this export, I get:

	~~but~~, ~~i get~~:		{{Highlight
			\| code = # mount -t nfs -o vers=4 bnas:surveillance/events/v2 /mnt
			mount.nfs: mounting bnas:surveillance/events/v2 failed, reason given by server: No such file or directory
			\| lang = terminal
			}}

	~~<nowiki>#</nowiki> mount -t nfs -o vers=4 bnas~~:~~surveillance/events/v2 /mnt~~		However, the parent directory works:

	mount.nfs~~: mounting~~ bnas:surveillance/~~events~~/~~v2 failed, reason given by server: No such file or directory~~		{{Highlight
			\| code = # mount -t nfs -o vers=4 bnas:surveillance/events /mnt
			\| lang = terminal
			}}

	~~However, the parent directory works~~		'''Solution''': It appears that if the directory exists in the parent ZFS dataset, the NFS server will see that instead of the child ZFS mount. I fixed this after deleting the empty directory at <code>/surveillance/events</code> and then remounted the child ZFS dataset. The NFS mounts will work properly afterwards.

	~~<nowiki>#</nowiki> mount -t nfs -o vers=4 bnas~~:~~surveillance/events /mnt~~

	It appears that if the directory exists in the parent ZFS dataset, the NFS server will see that instead of the child ZFS mount. I fixed this after deleting the empty directory at /surveillance/events and then remounted the child ZFS dataset. The NFS mounts will work properly afterwards.

			=== Cannot change permission/ownership on file in nfs mounted directory: Operation not permitted ===
			As either root or a normal user on a system with a NFS mounted filesystem, changing the file permission or ownership fails.
			{{Highlight
			\| code = # chmod 755 test_file chmod: changing permissions of `test_file`: Operation not permitted
			\| lang = terminal
			}}
			'''Solution:''' Add the <code>no_root_squash</code> as an export option on the NFS server. After adding the option to <code>/etc/exports</code>, re-export on the NFS server by running:
			{{Highlight
			\| code = # exportfs -ra
			\| lang = terminal
			}}
			For security reasons, the default behavior is to squash on the server side. This is done so that untrusted systems aren't able to upload programs and set its setuid bit and have it run on a trusted system, for example.
	[[Category:FreeBSD]]		[[Category:FreeBSD]]
	{{Navbox Linux}}		{{Navbox Linux}}
	[[Category:Linux]]		[[Category:Linux]]
	{{Navbox Services}}		{{Navbox Services}}

Leo: /* Troubleshooting */

2022-01-19T08:12:00Z

Troubleshooting

@@ Line 208: / Line 208: @@
 # systemctl start nfs-lock
 }}
 [[Category:FreeBSD]]

Leo: /* Troubleshooting */

2021-07-03T03:16:56Z

Troubleshooting

← Older revision		Revision as of 03:16, 3 July 2021
Line 1:		Line 1:
	NFS is a Network File System originally developed by Sun Microsystems. As the name implies, it's a filesystem over the network and allows for a remote filesystem to be mounted locally via TCP or UDP.		NFS is a Network File System originally developed by Sun Microsystems. As the name implies, it's a filesystem over the network and allows for a remote filesystem to be mounted locally via TCP or UDP.

	== Setting up NFS ==		==Setting up NFS==

	===FreeBSD===		===FreeBSD===
Line 63:		Line 63:
	}}		}}

	==== Defining your exports ====		====Defining your exports====
	Filesystem exports are defined in <code>/etc/exports</code>. This file specifies what host has access to a specific filesystem.		Filesystem exports are defined in <code>/etc/exports</code>. This file specifies what host has access to a specific filesystem.

Line 95:		Line 95:
	\|}		\|}

	==== Starting the NFS server ====		====Starting the NFS server====
	On most recent systems using systemd, start the NFS service by running:		On most recent systems using systemd, start the NFS service by running:
	{{Highlight		{{Highlight
Line 108:		Line 108:
	If everything's working, you should see <code>nfsd</code> running. There are also some other daemons that you should be aware of:		If everything's working, you should see <code>nfsd</code> running. There are also some other daemons that you should be aware of:

	* <code>nfsd</code> is the NFS service		*<code>nfsd</code> is the NFS service
	* <code>lockd</code> and statd handles file locking		*<code>lockd</code> and statd handles file locking
	* <code>mountd</code> handles the initial mount requests		*<code>mountd</code> handles the initial mount requests
	* <code>rquotad</code> handles filesystem quotas on exported volumes.		*<code>rquotad</code> handles filesystem quotas on exported volumes.

	==== Modifying exports after the NFS server has started ====		====Modifying exports after the NFS server has started====
	If you need to modify the exports file after the NFS server has started, you will need to re-export the file. Do so by running:		If you need to modify the exports file after the NFS server has started, you will need to re-export the file. Do so by running:
	{{Highlight		{{Highlight
Line 121:		Line 121:
	The options <code>-r</code> removes any exports that is no longer defined. <code>-a</code> exports all directories that are defined.		The options <code>-r</code> removes any exports that is no longer defined. <code>-a</code> exports all directories that are defined.

	== Advanced features ==		==Advanced features==
	Here are some notes covering more advanced and niche features with NFS. These are specific to Red Hat flavour of Linux.		Here are some notes covering more advanced and niche features with NFS. These are specific to Red Hat flavour of Linux.

Line 156:		Line 156:
	*https://unix.stackexchange.com/questions/438939/how-to-get-nfsv4-idmap-working-with-sec-sys/464950#464950		*https://unix.stackexchange.com/questions/438939/how-to-get-nfsv4-idmap-working-with-sec-sys/464950#464950

	=== Host access and deny policy ===		===Host access and deny policy===
	Use the <code>/etc/hosts.allow</code> and <code>/etc/hosts.deny</code> to control which computers have access to services on the server.		Use the <code>/etc/hosts.allow</code> and <code>/etc/hosts.deny</code> to control which computers have access to services on the server.

			=== Automounting ===
			See also: [[Autofs]]

			You can have filesystems automatically be mounted when accessed on demand. This might be useful if you wish to reduce the amount of NFS mounts on a system especially if the majority of the mounts aren't necessary (Eg. if you have each user's home directory as a separate NFS export). This is accomplished by using the <code>autofs</code> automounter program.

	==Troubleshooting==		==Troubleshooting==
Line 166:		Line 171:
	\|-		\|-
	\|<code>showmount -e $Server</code>		\|<code>showmount -e $Server</code>
	\|Run on a client to show all the NFS exports from $Server.		\|Run on a client to show all the NFS exports from <code>$Server</code>.
	\|-		\|-
	\|<code>nfsstat -s</code>		\|<code>nfsstat -s</code>
Line 174:		Line 179:
	\|Run on a client to show all NFS mounts in use. You can also use <code>df</code>.		\|Run on a client to show all NFS mounts in use. You can also use <code>df</code>.
	\|}		\|}
	~~<br />~~
	===~~{{code\|~~writing fd to kernel failed: errno 111}}===		=== writing fd to kernel failed: errno 111 ===
	If you get kernel errors similar to:		If you get kernel errors similar to:
	{{highlight\|lang=text\|code=		{{highlight\|lang=text\|code=

Leo at 03:11, 3 July 2021

2021-07-03T03:11:58Z

← Older revision		Revision as of 03:11, 3 July 2021
Line 70:		Line 70:
	\| code = /mnt serverA(rw,no_root_squash) serverB(rw,no_root_squash)		\| code = /mnt serverA(rw,no_root_squash) serverB(rw,no_root_squash)
	^ ^		^ ^
	\| `- remote hosts and export options		<nowiki>\|</nowiki> `- remote hosts and export options
	`- Mount point being exported		`- Mount point being exported
	\| lang = text		\| lang = text

Leo at 03:10, 3 July 2021

2021-07-03T03:10:46Z

Show changes

Leo: /* NFSv4 ID Mapping */

2020-03-24T20:14:16Z

NFSv4 ID Mapping

@@ Line 47: / Line 47: @@
 === NFSv4 ID Mapping ===
-* See: http://dfusion.com.au/wiki/tiki-index.php?page=Why+NFSv4+UID+mapping+breaks+with+AUTH_UNIX
+NFSv4 introduces a ID mapping feature that solves the problem of having users with different UID/GIDs on different systems.  On NFS v2/v3 systems using the AUTH_SYS/AUTH_UNIX(sec=sys) security mechanism, security was implemented based on UID/GID between the server and the client.  With NFS v4, the RPC ID Mapper is able to use user principal names rather than the numeric identifiers.
 == Troubleshooting ==

Leo: /* fcntl() failed - No locks available */

2019-09-12T05:52:20Z

fcntl() failed - No locks available

← Older revision		Revision as of 05:52, 12 September 2019
Line 70:		Line 70:
	}}		}}

	The /home directory is a automounted NFS share from a remote server. To resolve this issue, ensure that nfslock is running on both the server and client machine.		The /home directory is a automounted NFS share from a remote server.

			To resolve this issue, ensure that {{code\|nfslock}} is running on both the server and client machine.
			{{highlight\|lang=terminal\|code=
			# service nfslock start
			## or
			# systemctl start nfs-lock
			}}

	[[Category:FreeBSD]]		[[Category:FreeBSD]]
	{{Navbox Linux}}[[Category:Linux]]		{{Navbox Linux}}[[Category:Linux]]
	{{Navbox Services}}		{{Navbox Services}}

Leo: Formatting and imported WP content from http://leo.steamr.com/2011/02/fcntl-failed-no-locks-available/

2019-09-12T03:22:20Z

Formatting and imported WP content from http://leo.steamr.com/2011/02/fcntl-failed-no-locks-available/

← Older revision		Revision as of 03:22, 12 September 2019
Line 1:		Line 1:
	== FreeBSD ==		== FreeBSD ==

	To set a FreeBSD machine up as a NFS server, add the following lines to {{code\|/etc/rc.conf}}		To set a FreeBSD machine up as a NFS server, add the following lines to {{code\|/etc/rc.conf}}

	~~<syntaxhighlight~~ lang="text~~" line start~~=~~"1" enclose="div">~~		{{highlight\|lang=text\|code=
	mountd_enable="YES"		mountd_enable="YES"
	nfs_server_enable="YES"		nfs_server_enable="YES"
Line 10:		Line 9:
	rpc_statd_enable="YES"		rpc_statd_enable="YES"
	mountd_flags="-r"		mountd_flags="-r"
	~~</syntaxhighlight>~~		}}

	Since {{code\|/storage}} is a single mount, you will need to define the same directories exactly the same for all the different permissions you want to define in {{code\|/etc/exports}}. For example:		Since {{code\|/storage}} is a single mount, you will need to define the same directories exactly the same for all the different permissions you want to define in {{code\|/etc/exports}}. For example:

	~~<syntaxhighlight~~ lang="text~~" line start~~=~~"1" enclose="div">~~		{{highlight\|lang=text\|code=
	/storage/downloads /storage/backups/esxi -ro -network 10.1.1.0 -mask 255.255.255.0		/storage/downloads /storage/backups/esxi -ro -network 10.1.1.0 -mask 255.255.255.0
	/storage/downloads /storage/backups/esxi -maproot=root -network 10.1.1.2 -mask 255.255.255.255		/storage/downloads /storage/backups/esxi -maproot=root -network 10.1.1.2 -mask 255.255.255.255
	~~</syntaxhighlight>~~		}}

	It would be '''invalid''' if the second line had only {{code\|/storage/downloads}} as it will cause the first entry to be ignored by the parser.		It would be '''invalid''' if the second line had only {{code\|/storage/downloads}} as it will cause the first entry to be ignored by the parser.
Line 23:		Line 22:
	To apply your changes, restart {{code\|mountd}}.		To apply your changes, restart {{code\|mountd}}.

	~~<syntaxhighlight~~ lang=~~"bash" line start~~=~~"1" enclose="div">~~		{{highlight\|lang=text\|code=
	service mountd restart		# service mountd restart
	~~</syntaxhighlight>~~		}}

	{{code\|showmount}} should show both exports:		{{code\|showmount}} should show both exports:
	~~<syntaxhighlight~~ lang=~~"bash" line start~~=~~"1" enclose="div">~~		{{highlight\|lang=text\|code=
	showmount -e		# showmount -e
	Exports list on localhost:		Exports list on localhost:
	/storage/downloads 10.1.1.0 10.1.1.2		/storage/downloads 10.1.1.0 10.1.1.2
	/storage/backups/esxi 10.1.1.0 10.1.1.2		/storage/backups/esxi 10.1.1.0 10.1.1.2
	~~</syntaxhighlight>~~		}}


	== Linux ==		== Linux ==

	=== Firewall ===		=== Firewall ===
			To use NFS, ensure the firewall is configured so that NFS, mountd, and RPC Bind can communicate.

	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
	# firewall-cmd --permanent --add-service=nfs		# firewall-cmd --permanent --add-service=nfs
Line 49:		Line 49:
	* See: http://dfusion.com.au/wiki/tiki-index.php?page=Why+NFSv4+UID+mapping+breaks+with+AUTH_UNIX		* See: http://dfusion.com.au/wiki/tiki-index.php?page=Why+NFSv4+UID+mapping+breaks+with+AUTH_UNIX

	=== ~~Troubleshooting~~ ===		== Troubleshooting ==
	rpc.nfsd: writing fd to kernel failed: errno 111 (Connection refused)		=== {{code\|writing fd to kernel failed: errno 111}} ===
			If you get kernel errors similar to:
			{{highlight\|lang=text\|code=
			rpc.nfsd: writing fd to kernel failed: errno 111 (Connection refused)
			}}

			You need to start the {{code\|rpc.bind}} service.
			{{highlight\|lang=text\|code=
			# /etc/init.d/rpcbind start
			}}

	~~You need to start rpc.bind~~		=== fcntl() failed - No locks available ===

	/~~etc~~/~~init~~.d/~~rpcbind start~~		While attempting to get Dovecot with LDAP authentication working, I've ran into the following error:

			{{highlight\|lang=text\|code=
			dovecot: Feb 22 22:43:02 Error: IMAP(leo): fcntl() failed with file /home/leo/Maildir/dovecot.index.log: No locks available
			dovecot: Feb 22 22:43:02 Error: IMAP(leo): mail_index_wait_lock_fd() failed with file /home/leo/Maildir/dovecot.index.log: No locks available
			}}

			The /home directory is a automounted NFS share from a remote server. To resolve this issue, ensure that nfslock is running on both the server and client machine.

	[[Category:FreeBSD]]		[[Category:FreeBSD]]
	{{Navbox Linux}}[[Category:Linux]]		{{Navbox Linux}}[[Category:Linux]]

	{{Navbox Services}}		{{Navbox Services}}

Leo: Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

2019-09-01T06:22:03Z

Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

← Older revision		Revision as of 06:22, 1 September 2019
Line 57:		Line 57:

	[[Category:FreeBSD]]		[[Category:FreeBSD]]
	[[Category:Linux]]~~{{Navbox Linux}}~~		{{Navbox Linux}}[[Category:Linux]]

	{{Navbox Services}}		{{Navbox Services}}

Leo: Text replacement - "{{Navbox Linux}}{{Navbox Linux}}" to "{{Navbox Linux}}"

2019-09-01T05:11:11Z

Text replacement - "{{Navbox Linux}}{{Navbox Linux}}" to "{{Navbox Linux}}"

← Older revision		Revision as of 05:11, 1 September 2019
Line 57:		Line 57:

	[[Category:FreeBSD]]		[[Category:FreeBSD]]
	[[Category:Linux]]~~{{Navbox Linux}}~~{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}

	{{Navbox Services}}		{{Navbox Services}}