WIP: stg My edits to the NFS server setup docs #175
1 changed files with 49 additions and 53 deletions
fixed some typos in nfs filesharing docs and brought versions in line for FC43
Jocelyn Gould
commit
7e59aa8222
|
|
@ -1,25 +1,22 @@
|
|||
= File sharing with NFS – Installation
|
||||
Peter Boy (pboy);Emmanuel Seyman (eseyman); Jason Beard (cooltshirtguy); Otto Liljalaakso
|
||||
Peter Boy (pboy);Emmanuel Seyman (eseyman); Jason Beard (cooltshirtguy); Otto Liljalaakso; Jocelyn Gould (korora)
|
||||
//:page-authors: {author}
|
||||
:revnumber: F39
|
||||
:revdate: 2024-01-10
|
||||
:revnumber: F43
|
||||
:revdate: 2025-10-30
|
||||
//:page-aliases: installation-an-introduction.adoc
|
||||
|
||||
|
||||
[abstract]
|
||||
// ------
|
||||
NFS, the Network File System, is a mature protocol designed to share files between Unix-type systems over TCP/IP networks. Fedora Server Edition installs by default the kernel space NFS server, but without configuration and activation. This article describes its configuration and activation.
|
||||
[WARNING]
|
||||
====
|
||||
*__This is the staging area__*
|
||||
|
||||
__Current status__: Not yet modified
|
||||
====
|
||||
// ------
|
||||
|
||||
The objective of this guide is how to setup __NFS Server__ on a Fedora Server Edition. For information on how to setup the client part, consult your OS's documentation.
|
||||
The objective of this guide is how to setup __NFS Server__ on a Fedora Server Edition. For information on how to setup the client part, consult your OS's documentation.
|
||||
|
||||
NFS is a Network service in Linux used to share the files and directories of the Server to users (clients) on the network. It allows clients to _mount_ a remote directory or complete filesystem over a network and interact with it much like local storage is accessed. It is the same principle as Map Drive in Windows Systems. One of it most used benefits is to store and access data on central location.
|
||||
|
||||
The NFS Protocol was first introduced by Sun Microsystem in 1984. The protocol has evolved from its origins. Over the years, new versions have been released, adding new features. Currently, NFS v4.2 is the current version. Perhaps most practically significant is the optional user identification as well as a virtual ROOT.
|
||||
The NFS Protocol was first introduced by Sun Microsystem in 1984. The protocol has evolved from its origins. Over the years, new versions have been released, adding new features. Currently, NFS v4.2 is the current version. Perhaps most practically significant is the optional user identification as well as a virtual ROOT.
|
||||
|
||||
NFS protocol is not encrypted by default, and unlike Samba, unless you activate the optional feature it does not provide user authentication. Access to the server is restricted by the clients’ IP addresses or hostnames.
|
||||
|
||||
|
|
@ -33,7 +30,7 @@ There are three packages which provide basic support for kernel space NFS:
|
|||
nfs-utils::
|
||||
is the main package and provides a daemon for the kernel NFS server and related tools. It also contains the _showmount_ program to query the mount daemon on a remote host for available ressources, eg listing the clients which are mounted on that host. It also contains the mount.nfs and umount.nfs programs.
|
||||
libnfsidmap::
|
||||
NFSv4 User and Group ID Mapping Library that handles mapping between names and ids for NFSv4.
|
||||
NFSv4 User and Group ID Mapping Library that handles mapping between names and ids for NFSv4.
|
||||
sssd-nfs-idmap::
|
||||
SSSD plug-in provides a way for rpc.idmapd to call SSSD to map UIDs/GIDs to names and vice versa. It can be also used for mapping principal (user) name to IDs(UID or GID) or to obtain groups which user are member of.
|
||||
|
||||
|
|
@ -41,9 +38,9 @@ Ensure that these packages are really installed.
|
|||
[source,]
|
||||
----
|
||||
[…]$ rpm -qa | grep nfs
|
||||
libnfsidmap-2.6.2-2.rc6.fc37
|
||||
sssd-nfs-idmap-2.8.2-1.fc37
|
||||
nfs-utils-2.6.2-2.rc6.fc37
|
||||
libnfsidmap-2.8.4-0.fc43
|
||||
sssd-nfs-idmap-2.11.1-4.fc43
|
||||
nfs-utils-2.8.4-0.fc43
|
||||
----
|
||||
|
||||
If a package missing, then a system administrator can simply reinstall it.
|
||||
|
|
@ -51,37 +48,37 @@ If a package missing, then a system administrator can simply reinstall it.
|
|||
|
||||
=== Organizing storage
|
||||
|
||||
In principle, NFS can share any directory on the server. However, it makes sense to concentrate at least generally shared files in a central location instead of scattering everything around.
|
||||
In principle, NFS can share any directory on the server. However, it makes sense to concentrate at least generally shared files in a central location instead of scattering everything around.
|
||||
|
||||
Furthermore, it is a best practice is to use a global NFS root directory and bind mount those directories which are holding specific data at specific locations to the share mount point.
|
||||
Furthermore, it is a best practice is to use a global NFS root directory and bind mount those directories which are holding specific data at specific locations to the share mount point.
|
||||
|
||||
In accordance to the Filesystem Hierarchie Standard (FSH), using a /srv/nfs4 directory as the NFS root is a good choice.
|
||||
|
||||
Following Fedora Server storage rationale, a system administrator will create a logical volume and mount it to either `/srv` to create a Logical Volume as a pool for various services, or `/srv/nfs` to create a Logical Volume, probably thin provisioned, for each service. In case of systematic extensive utilization, a static LVM volume of fixed size is advisable. For occasional usage, a thin provisioned logical LVM volume might be the better choice.
|
||||
Following Fedora Server storage rationale, a system administrator will create a logical volume and mount it to either `/srv` to create a Logical Volume as a pool for various services, or `/srv/nfs` to create a Logical Volume, probably thin provisioned, for each service. In case of systematic extensive utilization, a static LVM volume of fixed size is advisable. For occasional usage, a thin provisioned logical LVM volume might be the better choice.
|
||||
|
||||
In this guide we will demontrate the latter and create a thin provisioned LV for each service in /srv.
|
||||
|
||||
1. *Create a nfs export directory in /srv*
|
||||
1. *Create a nfs export directory in /srv*
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]$ sudo mkdir /srv/nfs
|
||||
----
|
||||
+
|
||||
The created directory is by default readable for everyone, but not writable.
|
||||
The created directory is by default readable for everyone, but not writable.
|
||||
|
||||
2. *Create a user and group nfs*
|
||||
+
|
||||
As already stated, nfs does not provide user authentication. A common way is to either use the same UID/GID for a given user on all devices on the network or to map every client to user nobody and make the export files read- and writable for everybody, i.e. for any user of the system. The former is difficult to achieve without a central logon instance, and the latter is at best inconvenient from a security point of view. So we use a pseudo user without a home directory and without a login shell, who owns all exported files and directories by default.
|
||||
As already stated, nfs does not provide user authentication. A common way is to either use the same UID/GID for a given user on all devices on the network or to map every client to user nobody and make the export files read- and writable for everybody, i.e. for any user of the system. The former is difficult to achieve without a central logon instance, and the latter is at best inconvenient from a security point of view. So we use a pseudo user without a home directory and without a login shell, who owns all exported files and directories by default.
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]$ sudo adduser -c 'nfs pseudo user' -m /nonexisting -M -r -s /sbin/nologin nfs
|
||||
[…]$ sudo adduser -c 'nfs pseudo user' -M -r -s /sbin/nologin nfs
|
||||
----
|
||||
|
||||
3. *Create and mount the required Logical Volumes*
|
||||
+
|
||||
The easiest way is to use Cockpit with its storage module. Select on the right side the root Volume Group and select "Add logical volume" in the new window.
|
||||
The easiest way is to use Cockpit with its storage module. Select on the right side the root Volume Group and select "Add logical volume" in the new window.
|
||||
+
|
||||
image::services/nfs-server-inst-001.png[Create logical volume]
|
||||
+
|
||||
|
|
@ -91,7 +88,7 @@ In the list of logical volumes that is then displayed, the line with the newly c
|
|||
+
|
||||
image::services/nfs-server-inst-005.png[Create thin volume]
|
||||
+
|
||||
Fill in the form appropriately. Keep in mind that you are specifying the maximum value for the size of the volume. The system starts with a much smaller initial value and expands it as needed.
|
||||
Fill in the form appropriately. Keep in mind that you are specifying the maximum value for the size of the volume. The system starts with a much smaller initial value and expands it as needed.
|
||||
+
|
||||
After the creation of the volume the list of logical volumes contains a new entry for the logical Volume just created with an option "Format". It opens a new form.
|
||||
+
|
||||
|
|
@ -110,7 +107,7 @@ For hardcore system administrators with mouse allergy, the whole thing via CLI.
|
|||
[…]# vim /etc/fstab
|
||||
...
|
||||
/dev/mapper/fedora-root / xfs defaults 0 0
|
||||
/dev/mapper/fedora-nfs /srv/nfs xfs defaults 0 0
|
||||
/dev/mapper/fedora-nfs /srv/nfs xfs defaults 0 0
|
||||
...
|
||||
----
|
||||
+
|
||||
|
|
@ -123,29 +120,29 @@ Finallly mount the created filesystem.
|
|||
|
||||
4. *Create and configure the directories to share*
|
||||
+
|
||||
In a typical use case you may create a directory 'common' to widely share data and a directory 'project', in which a team member shares data located in the home directory with the team.
|
||||
In a typical use case you may create a directory 'common' to widely share data and a directory 'project', in which a team member shares data located in the home directory with the team.
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# sudo mkdir -p /srv/nfs/{common,project}
|
||||
[…]# sudo chown -R nfs.nfs /srv/nfs/*
|
||||
[…]# sudo mount --bind /home/USER/PROJECT /srv/nfs/project
|
||||
[…]# sudo chown -R nfs:nfs /srv/nfs/*
|
||||
[…]# sudo mount --bind /home/USER/PROJECT /srv/nfs/project
|
||||
----
|
||||
+
|
||||
To make the bind mount(s) permanent, add the following entries to the /etc/fstab file:
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# vi /etc/fstab
|
||||
[…]# vi /etc/fstab
|
||||
/home/USER/PROJECT /srv/nfs/PROJECT none bind 0 0
|
||||
----
|
||||
|
||||
|
||||
== Optional server configuration
|
||||
|
||||
NFS server configuration uses 3 files
|
||||
NFS server configuration uses 3 files
|
||||
|
||||
* /etc/nfs.conf
|
||||
* /etc/nfs.conf
|
||||
* /etc/nfsmount.conf
|
||||
* /etc/idmapd.conf
|
||||
|
||||
|
|
@ -155,7 +152,7 @@ The commented out lines describe the default built in configuration.
|
|||
+
|
||||
[source,]
|
||||
----
|
||||
[…]$ sudo vi /etc/nfs.conf
|
||||
[…]$ sudo vi /etc/nfs.conf
|
||||
/home/USER/PROJECT /srv/nfs/PROJECT none bind 0 0
|
||||
----
|
||||
|
||||
|
|
@ -168,14 +165,14 @@ NFS uses port 2049 which is blocked in a Fedora standard installation by defaut
|
|||
[source,]
|
||||
----
|
||||
[…]# firewall-cmd --permanent --add-service=nfs
|
||||
[…]# firewall-cmd --reload
|
||||
[…]# firewall-cmd --reload
|
||||
----
|
||||
|
||||
2. *Start NFS enabling autostart at boot time*
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# systemctl enable nfs-server --now
|
||||
[…]# systemctl enable nfs-server --now
|
||||
[…]# systemctl status nfs-server
|
||||
----
|
||||
+
|
||||
|
|
@ -238,7 +235,7 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/etc/nfs/common *(rw,sync)
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
||||
Example 2::
|
||||
|
|
@ -248,7 +245,7 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/etc/nfs/common *(rw,sync)
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
||||
Example 3::
|
||||
|
|
@ -258,7 +255,7 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/etc/nfs/common *(rw,sync)
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
||||
Example 4::
|
||||
|
|
@ -268,7 +265,7 @@ Export the directory /srv/nfs/common with everyone, i.e. every network device an
|
|||
----
|
||||
[…]$ sudo vi /etc/exports.d/common.exports
|
||||
<i(nsert)>
|
||||
/etc/nfs/common *(rw,sync)
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
||||
Example 6::
|
||||
|
|
@ -278,7 +275,7 @@ Export the directory /srv/nfs/projects with all users of a specific network devi
|
|||
----
|
||||
[…]$ sudo vi /etc/exports.d/projects.exports
|
||||
<i(nsert)>
|
||||
/etc/nfs/common *(rw,sync)
|
||||
/srv/nfs/common *(rw,sync)
|
||||
----
|
||||
|
||||
==== Connection options
|
||||
|
|
@ -293,7 +290,7 @@ Allow both read and write requests / only read requests on a NFS volume.
|
|||
sync/async::
|
||||
Reply to requests only after the changes have been committed to stable storage (Default) / allow the NFS server to violate the NFS protocol and reply to requests before any changes made by that request have been committed to stable storage.
|
||||
secure/insecure::
|
||||
Require that requests originate on an Internet port less than IPPORT_RESERVED (1024). (Default) / accepts all ports. using the insecure option allows clients such as Mac OS X to connect on ports above 1024. This option is not otherwise "insecure".
|
||||
Require that requests originate on an Internet port less than IPPORT_RESERVED (1024). (Default) / accepts all ports. using the insecure option allows clients such as Mac OS X to connect on ports above 1024. This option is not otherwise "insecure".
|
||||
wdelay/no_wdelay:: Delay committing a write request to disc slightly if it suspects that another related write request may be in progress or may arrive soon. (Default)
|
||||
This option has no effect if async is also set. The NFS server will normally delay committing a write request to disc slightly if it suspects that another related write request may be in progress or may arrive soon. This allows multiple write requests to be committed to disc with the one operation which can improve performance. If an NFS server received mainly small unrelated requests, this behaviour could actually reduce performance, so no_wdelay is available to turn it off.
|
||||
subtree_check/no_subtree_check::
|
||||
|
|
@ -318,7 +315,7 @@ When the nfs service starts, the /usr/sbin/exportfs command launches and reads t
|
|||
|
||||
When issued manually, the /usr/sbin/exportfs command allows the root user to selectively export or unexport directories without restarting the NFS service. When given the proper options, the /usr/sbin/exportfs command writes the exported file systems to /var/lib/nfs/xtab. Since rpc.mountd refers to the xtab file when deciding access privileges to a file system, changes to the list of exported file systems take effect immediately.
|
||||
|
||||
The following is a list of commonly used options available for /usr/sbin/exportfs:
|
||||
The following is a list of commonly used options available for /usr/sbin/exportfs:
|
||||
|
||||
|
||||
|
||||
|
|
@ -334,7 +331,7 @@ The following is a list of commonly used options available for /usr/sbin/exportf
|
|||
|
||||
-v — Verbose operation, where the file systems being exported or unexported are displayed in greater detail when the exportfs command is executed.
|
||||
|
||||
If no options are passed to the /usr/sbin/exportfs command, it displays a list of currently exported file systems.
|
||||
If no options are passed to the /usr/sbin/exportfs command, it displays a list of currently exported file systems.
|
||||
|
||||
|
||||
==== Using exportfs with NFSv4
|
||||
|
|
@ -349,13 +346,13 @@ For example, the following commands could be executed on an NFSv4 server:
|
|||
|
||||
[source,]
|
||||
----
|
||||
mkdir /exports
|
||||
mkdir /exports/opt
|
||||
mkdir /exports/etc
|
||||
mount --bind /usr/local/opt /exports/opt
|
||||
mount --bind /usr/local/etc /exports/etc
|
||||
exportfs -o fsid=0,insecure,no_subtree_check gss/krb5p:/exports
|
||||
exportfs -o rw,nohide,insecure,no_subtree_check gss/krb5p:/exports/opt
|
||||
mkdir /exports
|
||||
mkdir /exports/opt
|
||||
mkdir /exports/etc
|
||||
mount --bind /usr/local/opt /exports/opt
|
||||
mount --bind /usr/local/etc /exports/etc
|
||||
exportfs -o fsid=0,insecure,no_subtree_check gss/krb5p:/exports
|
||||
exportfs -o rw,nohide,insecure,no_subtree_check gss/krb5p:/exports/opt
|
||||
exportfs -o rw,nohide,insecure,no_subtree_check gss/krb5p:/exports/etc
|
||||
----
|
||||
|
||||
|
|
@ -366,7 +363,7 @@ Because of the pseudo-file systems feature, NFS version 2, 3 and 4 export config
|
|||
[source,]
|
||||
----
|
||||
/home
|
||||
/home/sam
|
||||
/home/sam
|
||||
/home/john
|
||||
/home/joe
|
||||
----
|
||||
|
|
@ -402,12 +399,12 @@ The difference being "server:/home" and "server:/". To make the exports configur
|
|||
/home *(rw,sync,nohide)
|
||||
----
|
||||
|
||||
Now with these exports, both "mount server:/home /mnt/home" and "mount -t nfs server:/home /mnt/home" will work as expected.
|
||||
Now with these exports, both "mount server:/home /mnt/home" and "mount -t nfs server:/home /mnt/home" will work as expected.
|
||||
|
||||
|
||||
== Testing the configuration
|
||||
|
||||
On client side:
|
||||
On client side:
|
||||
[source,]
|
||||
----
|
||||
[…]# showmount -e 192.168.12.200
|
||||
|
|
@ -442,6 +439,5 @@ TBD
|
|||
|
||||
== Further reading
|
||||
|
||||
* Upstream documentation: http://linux-nfs.org/wiki/index.php/Main_Page
|
||||
* Upstream documentation: http://linux-nfs.org/wiki/index.php/Main_Page
|
||||
* Linux manual page: https://man7.org/linux/man-pages/man5/exports.5.html
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue