Fixed merge conflicts.
This commit is contained in:
Peter Boy
commit
ef2594ce3a
1 changed files with 45 additions and 39 deletions
|
|
@ -1,8 +1,8 @@
|
|||
= File sharing with NFS – Installation
|
||||
Peter Boy (pboy);Emmanuel Seyman (eseyman); Jason Beard (cooltshirtguy); Otto Liljalaakso
|
||||
Peter Boy (pboy);Emmanuel Seyman (eseyman); Jason Beard (cooltshirtguy); Otto Liljalaakso; Jocelyn Gould (korora)
|
||||
//:page-authors: {author}
|
||||
:revnumber: F39
|
||||
:revdate: 2024-01-10
|
||||
:revnumber: F43
|
||||
:revdate: 2025-10-30
|
||||
//:page-aliases: installation-an-introduction.adoc
|
||||
|
||||
|
||||
|
|
@ -12,7 +12,7 @@ NFS, the Network File System, is a mature protocol designed to share files betwe
|
|||
|
||||
// ------
|
||||
|
||||
The objective of this guide is how to setup __NFS Server__ on a Fedora Server Edition. For information on how to setup the client part, consult your OS's documentation.
|
||||
The objective of this guide is how to setup __NFS Server__ on a Fedora Server Edition. For information on how to setup the client part, consult your OS's documentation.
|
||||
|
||||
NFS is a Network service in Linux used to share the files and directories of the Server to users (clients) on the network. It allows clients to _mount_ a remote directory or complete filesystem over a network and interact with it much like local storage is accessed. It is the same principle as Map Drive in Windows Systems. One of it most used benefits is to store and access data on central location.
|
||||
|
||||
|
|
@ -30,7 +30,7 @@ There are three packages which provide basic support for kernel space NFS:
|
|||
nfs-utils::
|
||||
is the main package and provides a daemon for the kernel NFS server and related tools. It also contains the _showmount_ program to query the mount daemon on a remote host for available ressources, eg listing the clients which are mounted on that host. It also contains the mount.nfs and umount.nfs programs.
|
||||
libnfsidmap::
|
||||
NFSv4 User and Group ID Mapping Library that handles mapping between names and ids for NFSv4.
|
||||
NFSv4 User and Group ID Mapping Library that handles mapping between names and ids for NFSv4.
|
||||
sssd-nfs-idmap::
|
||||
SSSD plug-in provides a way for rpc.idmapd to call SSSD to map UIDs/GIDs to names and vice versa. It can be also used for mapping principal (user) name to IDs(UID or GID) or to obtain groups which user are member of.
|
||||
|
||||
|
|
@ -38,9 +38,9 @@ Ensure that these packages are really installed.
|
|||
[source,]
|
||||
----
|
||||
[…]$ rpm -qa | grep nfs
|
||||
libnfsidmap-2.6.2-2.rc6.fc37
|
||||
sssd-nfs-idmap-2.8.2-1.fc37
|
||||
nfs-utils-2.6.2-2.rc6.fc37
|
||||
libnfsidmap-2.8.4-0.fc43
|
||||
sssd-nfs-idmap-2.11.1-4.fc43
|
||||
nfs-utils-2.8.4-0.fc43
|
||||
----
|
||||
|
||||
If a package missing, then a system administrator can simply reinstall it.
|
||||
|
|
@ -48,9 +48,9 @@ If a package missing, then a system administrator can simply reinstall it.
|
|||
|
||||
=== Organizing storage
|
||||
|
||||
In principle, NFS can share any directory on the server. However, it makes sense to concentrate at least generally shared files in a central location instead of scattering everything around.
|
||||
In principle, NFS can share any directory on the server. However, it makes sense to concentrate at least generally shared files in a central location instead of scattering everything around.
|
||||
|
||||
Furthermore, it is a best practice is to use a global NFS root directory and bind mount those directories which are holding specific data at specific locations to the share mount point.
|
||||
Furthermore, it is a best practice is to use a global NFS root directory and bind mount those directories which are holding specific data at specific locations to the share mount point.
|
||||
|
||||
In accordance to the Filesystem Hierarchie Standard (FSH), using a /srv/nfs4 directory as the NFS root is a good choice.
|
||||
|
||||
|
|
@ -58,27 +58,33 @@ Following Fedora Server storage rationale, a system administrator will create a
|
|||
|
||||
In this guide we will demontrate the latter and create a thin provisioned LV for each service in /srv.
|
||||
|
||||
1. *Create a nfs export directory in /srv*
|
||||
1. *Create a nfs export directory in /srv*
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]$ sudo mkdir /srv/nfs
|
||||
----
|
||||
+
|
||||
The created directory is by default readable for everyone, but not writable.
|
||||
The created directory is by default readable for everyone, but not writable.
|
||||
|
||||
2. *Create a user and group nfs*
|
||||
+
|
||||
As already stated, nfs does not provide user authentication. A common way is to either use the same UID/GID for a given user on all devices on the network or to map every client to user nobody and make the export files read- and writable for everybody, i.e. for any user of the system. The former is difficult to achieve without a central logon instance, and the latter is at best inconvenient from a security point of view. So we use a pseudo user without a home directory and without a login shell, who owns all exported files and directories by default.
|
||||
As already stated, nfs does not provide user authentication. A common way is to either use the same UID/GID for a given user on all devices on the network or to map every client to user nobody and make the export files read- and writable for everybody, i.e. for any user of the system. The former is difficult to achieve without a central logon instance, and the latter is at best inconvenient from a security point of view. So we use a pseudo user without a home directory and without a login shell, who owns all exported files and directories by default.
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
<<<<<<< HEAD
|
||||
[…]$ sudo adduser -c 'nfs pseudo user' -b /nonexisting -M -r -s /sbin/nologin nfs
|
||||
||||||| 1fa76ff
|
||||
[…]$ sudo adduser -c 'nfs pseudo user' -m /nonexisting -M -r -s /sbin/nologin nfs
|
||||
=======
|
||||
[…]$ sudo adduser -c 'nfs pseudo user' -M -r -s /sbin/nologin nfs
|
||||
>>>>>>> nfs-upd
|
||||
----
|
||||
|
||||
3. *Create and mount the required Logical Volumes*
|
||||
+
|
||||
The easiest way is to use Cockpit with its storage module. Select on the right side the root Volume Group and select "Add logical volume" in the new window.
|
||||
The easiest way is to use Cockpit with its storage module. Select on the right side the root Volume Group and select "Add logical volume" in the new window.
|
||||
+
|
||||
image::services/nfs-server-inst-001.png[Create logical volume]
|
||||
+
|
||||
|
|
@ -88,7 +94,7 @@ In the list of logical volumes that is then displayed, the line with the newly c
|
|||
+
|
||||
image::services/nfs-server-inst-005.png[Create thin volume]
|
||||
+
|
||||
Fill in the form appropriately. Keep in mind that you are specifying the maximum value for the size of the volume. The system starts with a much smaller initial value and expands it as needed.
|
||||
Fill in the form appropriately. Keep in mind that you are specifying the maximum value for the size of the volume. The system starts with a much smaller initial value and expands it as needed.
|
||||
+
|
||||
After the creation of the volume the list of logical volumes contains a new entry for the logical Volume just created with an option "Format". It opens a new form.
|
||||
+
|
||||
|
|
@ -107,7 +113,7 @@ For hardcore system administrators with mouse allergy, the whole thing via CLI.
|
|||
[…]# vim /etc/fstab
|
||||
...
|
||||
/dev/mapper/fedora-root / xfs defaults 0 0
|
||||
/dev/mapper/fedora-nfs /srv/nfs xfs defaults 0 0
|
||||
/dev/mapper/fedora-nfs /srv/nfs xfs defaults 0 0
|
||||
...
|
||||
----
|
||||
+
|
||||
|
|
@ -140,9 +146,9 @@ To make the bind mount(s) permanent, add the following entries to the /etc/fstab
|
|||
|
||||
== Optional server configuration
|
||||
|
||||
NFS server configuration uses 3 files
|
||||
NFS server configuration uses 3 files
|
||||
|
||||
* /etc/nfs.conf
|
||||
* /etc/nfs.conf
|
||||
* /etc/nfsmount.conf
|
||||
* /etc/idmapd.conf
|
||||
|
||||
|
|
@ -165,14 +171,14 @@ NFS uses port 2049 which is blocked in a Fedora standard installation by defaut.
|
|||
[source,]
|
||||
----
|
||||
[…]# firewall-cmd --permanent --add-service=nfs
|
||||
[…]# firewall-cmd --reload
|
||||
[…]# firewall-cmd --reload
|
||||
----
|
||||
|
||||
2. *Start NFS enabling autostart at boot time*
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# systemctl enable nfs-server --now
|
||||
[…]# systemctl enable nfs-server --now
|
||||
[…]# systemctl status nfs-server
|
||||
----
|
||||
+
|
||||
|
|
@ -235,7 +241,7 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/etc/nfs/common *(rw,sync)
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
||||
Example 2::
|
||||
|
|
@ -245,7 +251,7 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/etc/nfs/common *(rw,sync)
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
||||
Example 3::
|
||||
|
|
@ -255,7 +261,7 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/etc/nfs/common *(rw,sync)
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
||||
Example 4::
|
||||
|
|
@ -265,7 +271,7 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/etc/nfs/common *(rw,sync)
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
||||
Example 6::
|
||||
|
|
@ -275,7 +281,7 @@ Export the directory /srv/nfs/projects with all users of a specific network devi
|
|||
----
|
||||
[…]$ sudo vi /etc/exports.d/projects.exports
|
||||
<i(nsert)>
|
||||
/etc/nfs/common *(rw,sync)
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
||||
==== Connection options
|
||||
|
|
@ -291,6 +297,7 @@ sync/async::
|
|||
Reply to requests only after the changes have been committed to stable storage (Default) / allow the NFS server to violate the NFS protocol and reply to requests before any changes made by that request have been committed to stable storage.
|
||||
secure/insecure::
|
||||
Require that requests originate on an Internet port less than IPPORT_RESERVED (1024). (Default) / accepts all ports. using the insecure option allows clients such as Mac OS X to connect on ports above 1024. This option is not otherwise "insecure".
|
||||
|
||||
wdelay/no_wdelay:: Delay committing a write request to disc slightly if it suspects that another related write request may be in progress or may arrive soon. (Default)
|
||||
This option has no effect if async is also set. The NFS server will normally delay committing a write request to disc slightly if it suspects that another related write request may be in progress or may arrive soon. This allows multiple write requests to be committed to disc with the one operation which can improve performance. If an NFS server received mainly small unrelated requests, this behaviour could actually reduce performance, so no_wdelay is available to turn it off.
|
||||
subtree_check/no_subtree_check::
|
||||
|
|
@ -315,7 +322,7 @@ When the nfs service starts, the /usr/sbin/exportfs command launches and reads t
|
|||
|
||||
When issued manually, the /usr/sbin/exportfs command allows the root user to selectively export or unexport directories without restarting the NFS service. When given the proper options, the /usr/sbin/exportfs command writes the exported file systems to /var/lib/nfs/xtab. Since rpc.mountd refers to the xtab file when deciding access privileges to a file system, changes to the list of exported file systems take effect immediately.
|
||||
|
||||
The following is a list of commonly used options available for /usr/sbin/exportfs:
|
||||
The following is a list of commonly used options available for /usr/sbin/exportfs:
|
||||
|
||||
|
||||
|
||||
|
|
@ -331,7 +338,7 @@ The following is a list of commonly used options available for /usr/sbin/exportf
|
|||
|
||||
-v — Verbose operation, where the file systems being exported or unexported are displayed in greater detail when the exportfs command is executed.
|
||||
|
||||
If no options are passed to the /usr/sbin/exportfs command, it displays a list of currently exported file systems.
|
||||
If no options are passed to the /usr/sbin/exportfs command, it displays a list of currently exported file systems.
|
||||
|
||||
|
||||
==== Using exportfs with NFSv4
|
||||
|
|
@ -346,13 +353,13 @@ For example, the following commands could be executed on an NFSv4 server:
|
|||
|
||||
[source,]
|
||||
----
|
||||
mkdir /exports
|
||||
mkdir /exports/opt
|
||||
mkdir /exports/etc
|
||||
mount --bind /usr/local/opt /exports/opt
|
||||
mount --bind /usr/local/etc /exports/etc
|
||||
exportfs -o fsid=0,insecure,no_subtree_check gss/krb5p:/exports
|
||||
exportfs -o rw,nohide,insecure,no_subtree_check gss/krb5p:/exports/opt
|
||||
mkdir /exports
|
||||
mkdir /exports/opt
|
||||
mkdir /exports/etc
|
||||
mount --bind /usr/local/opt /exports/opt
|
||||
mount --bind /usr/local/etc /exports/etc
|
||||
exportfs -o fsid=0,insecure,no_subtree_check gss/krb5p:/exports
|
||||
exportfs -o rw,nohide,insecure,no_subtree_check gss/krb5p:/exports/opt
|
||||
exportfs -o rw,nohide,insecure,no_subtree_check gss/krb5p:/exports/etc
|
||||
----
|
||||
|
||||
|
|
@ -363,7 +370,7 @@ Because of the pseudo-file systems feature, NFS version 2, 3 and 4 export config
|
|||
[source,]
|
||||
----
|
||||
/home
|
||||
/home/sam
|
||||
/home/sam
|
||||
/home/john
|
||||
/home/joe
|
||||
----
|
||||
|
|
@ -399,12 +406,12 @@ The difference being "server:/home" and "server:/". To make the exports configur
|
|||
/home *(rw,sync,nohide)
|
||||
----
|
||||
|
||||
Now with these exports, both "mount server:/home /mnt/home" and "mount -t nfs server:/home /mnt/home" will work as expected.
|
||||
Now with these exports, both "mount server:/home /mnt/home" and "mount -t nfs server:/home /mnt/home" will work as expected.
|
||||
|
||||
|
||||
== Testing the configuration
|
||||
|
||||
On client side:
|
||||
On client side:
|
||||
[source,]
|
||||
----
|
||||
[…]# showmount -e 192.168.12.200
|
||||
|
|
@ -439,6 +446,5 @@ TBD
|
|||
|
||||
== Further reading
|
||||
|
||||
* Upstream documentation: http://linux-nfs.org/wiki/index.php/Main_Page
|
||||
* Upstream documentation: http://linux-nfs.org/wiki/index.php/Main_Page
|
||||
* Linux manual page: https://man7.org/linux/man-pages/man5/exports.5.html
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue