Tag/tag.png

Duplicate Article
This article covers the same material as another article. More info...

I have started moving this information to SettingUpNFSHowTo

Installation

The required packages are different depending on if the system is a client or a server. In this Howto, the server is the host that has the files you want to share and the client is the host that will be mounting the NFS share.

After you finish installing nfs-kernel-server, you might see failure to start nfs-kernel-server due to missing entries in /etc/exports. Remember to restart the service when you finish configuring.

For the error message:

mount.nfs4: No such device

You will have to load the nfs module with the command

modprobe nfs

NFSv4 without Kerberos

NFSv4 Server

NFSv4 exports exist in a single pseudo filesystem, where the real directories are mounted with the --bind option. Here is some additional information regarding this fact.

and mount the real users directory with:

sudo mount --bind /home/users /export/users 

To save us from retyping this after every reboot we add the following line to /etc/fstab:

/home/users    /export/users   none    bind  0  0 

NFSv4 Client

Not clear what is meant by UID/GID on the export being generic. This guide does not explicitly state that idmapd must also run on the client side, i.e. /etc/default/nfs-common needs the same settings as described in the server section. If idmapd is running the UID/GID are mapped correctly. Check with ps ax|grep rpc that rpc.idmapd is running.

and execute this mount after a short pause once all devices are loaded. Add the following lines to /etc/rc.local

NFSv4 and Autofs

Automount (or autofs) can be used in combination with NFSv4. Details on the configuration of autofs can be found in Autofs. The configuration is identical to NFSv2 and NFSv3 except that you have to specify -fstype=nfs4 as option. Automount supports NFSv4's feature to mount all file systems exported by server at once. The exports are then treated as an entity, i.e. they are "all" mounted when you step into "one" directory on the NFS server's file systems. When auto-mounting each file system separately the behavior is slightly different. In that case you would have to step into "each" file system to make it show up on the NFS client.

NFSv4 and NFSv3 simultaneously

NFSv4 and NFSv3 can be used simultaneously on a NFS server as well as on a NFS client. You have to setup NFSv3 on your NFS server (see SettingUpNFSHowTo). You can then export a file system with NFSv4 and NFSv3 simultaneously. Just put the appropriate export statements into /etc/exports and you are done. You might want to do this when you have NFS clients that don't support NFSv4, e.g. Mac OS X and Windows clients. But don't forget about the security risks of NFS with clients that can not be trusted.

NFSv4 with Kerberos

When using NFS without kerberos the security of all data in the NFS share depends on the integrity of all clients and the security of the network connections. If you use kerberos the security doesn't depend on all client machines because the server gives access to users with a valid kerberos ticket only. The security isn't completely delegated to the client machines (unlike without kerberos). Therefore you need a principal in your kerberos realm for each user who want's to access the NFS share. See Kerberos in the Ubuntu Server Guide on this topic. The section "Kerberos Linux Client" applies also to Ubuntu 8.04.

You need a working Kerberos (MIT or Heimdal) KDC (Key Distribution Center) before continuing. NFS4 and Kerberos work fine with Ubuntu 8.04; they do not seem to work with the (much) older Ubuntu 6.06, or at least I couldn't get Heimdal to work correctly.

Please note, that we have three different entities: the Kerberos-server; the NFS-server and the NFS-client. Your Kerberos-server (or KDC) and NFS-server could be the same machine, but they could also very well be separate entities. We will use separate "prompts" to distinguish, i.e. if you see

... this means you need to type echo "hello" on the KDC.

Please note that you can now (with Ubuntu 8.04 and later) use any encryption type you want, there is no more need to extract only des-cbc-crc, as most sites suggest.

Please also note, that des-cbc-crc encryption is depreciated and, starting with Ubuntu 10.04, is no longer supported by default in the Kerberos libraries. For nfs4 to work, you need to add allow_weak_crypto = true to /etc/krb5.conf

MIT

Heimdal

Create and distribute credentials

NFSv4 needs machine credentials for the server and every client, which wants to use the NFSv4 security features.

Create the credentials for the nfs-server and all nfs-clients on the Kerberos KDC and distribute the extraced keys with scp to the destination

You can make sure that only this entry has been created by executing "sudo klist -e -k /etc/krb5.keytab".

Create nfs/ principals

Authenticate as your admin user. You can do this from any machine in your kerberos-domain, as long as your kadmind is running; then add principals for your server and client machines. Replace "nfs-server.domain" with the fully qualified domain name of the machines. For example, if your server is called "snoopy" and your domain is "office.example.com", you would add a principal named "nfs/snoopy.office.example.com" for the server. Note: kadmin must be run with -l (locally) on the KDC if there is no kadmind. Please be aware of Bug 309738.

Heimdal

$ kinit kadmin/admin
$ kadmin add -r nfs/nfs-server.domain
$ kadmin add -r nfs/nfs-client.domain

Now add these to the keytab-files on your NFS-server and client. Log in to your NFSserver (as root, because you will need to edit the /etc/krb5.keytab file) and initialize as Kerberos administrator. If your domain is fully kerberized, logging in as root will automatically give you the right access, in which case you don't need to use "kinit" anymore.

NFSserver# kinit kadmin/admin
NFSserver# ktutil get nfs/nfs-server.domain

And add it to the client's keytab file:

NFSclient# kinit kadmin/admin
NFSclient# ktutil get nfs/nfs-client.domain

MIT

$ kinit admin/admin
$ kadmin -q "addprinc -randkey nfs/nfs-server.domain"
$ kadmin -q "addprinc -randkey nfs/nfs-client.domain"

Now add these to the keytab-files on your NFS-server and client. Log in to your NFSserver (as root, because you will need to edit the /etc/krb5.keytab file) and initialize as Kerberos administrator.

NFSserver# kadmin -p admin/admin -q "ktadd nfs/nfs-server.domain"

And add it to the client's keytab file:

NFSclient# kadmin -p admin/admin -q "ktadd nfs/nfs-client.domain"

NFSv4 Server with Kerberos

MIT:

# ktutil
ktutil:  rkt /etc/krb5.keytab
ktutil:  list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    2 nfs/nfs-server.domain@DOMAIN

Heimdal:

# ktutil list
FILE:/etc/krb5.keytab:

Vno  Type                     Principal
  6  des-cbc-md5              nfs/snoopy.office.example.com@OFFICE.EXAMPLE.COM
  6  des-cbc-md4              nfs/snoopy.office.example.com@OFFICE.EXAMPLE.COM
  6  des-cbc-crc              nfs/snoopy.office.example.com@OFFICE.EXAMPLE.COM
  6  aes256-cts-hmac-sha1-96  nfs/snoopy.office.example.com@OFFICE.EXAMPLE.COM
  6  des3-cbc-sha1            nfs/snoopy.office.example.com@OFFICE.EXAMPLE.COM
  6  arcfour-hmac-md5         nfs/snoopy.office.example.com@OFFICE.EXAMPLE.COM

etcetera (I removed the krb4 entries as you probably won't use them anyway).

MIT extra information:

Please note that you can specify allowed hosts only in the any authentication flavor. gss/krb5 flavours are accessible from anywhere, if you do not use additional firewall rules.

To export only with secure authentication flavors do not include a host(...) line in /etc/exports

The gss/krb5 flavours are:

To display your exports enter:

# exportfs -v 

NFSv4 Client with Kerberos

MIT:

# ktutil
ktutil:  rkt /etc/krb5.keytab
ktutil:  list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    2 nfs/nfs-client.domain@DOMAIN

Heimdal:

# ktutil list
FILE:/etc/krb5.keytab:

Vno  Type                     Principal
  6  des-cbc-md5              nfs/client.office.example.com@OFFICE.EXAMPLE.COM
  6  des-cbc-md4              nfs/client.office.example.com@OFFICE.EXAMPLE.COM
  6  des-cbc-crc              nfs/client.office.example.com@OFFICE.EXAMPLE.COM
  6  aes256-cts-hmac-sha1-96  nfs/client.office.example.com@OFFICE.EXAMPLE.COM
  6  des3-cbc-sha1            nfs/client.office.example.com@OFFICE.EXAMPLE.COM
  6  arcfour-hmac-md5         nfs/client.office.example.com@OFFICE.EXAMPLE.COM

Troubleshooting

First, take care of proper logging - by default almost nothing is logged.

To enable debug messages from NFS, edit /etc/default/nfs-kernel-server (quotes are important here):

RPCMOUNTDOPTS="--manage-gids --debug all"

To enable ipmapd debug output, edit /etc/idmpad.conf, and change the Verbosity level:

Verbosity = 5

To enable 3rd level verbose logging for rpc.gssd, run the following command as root:

echo 'exec rpc.gssd -vvv' > /etc/init/gssd.override

After restarting gssd (service gssd restart) check that the daemon has received new arguments:

ps xuwa | grep grep rpc.gssd
root      9857  0.0  0.4   2496  1220 ?        Ss   02:17   0:00 /usr/sbin/rpc.gssd -vvv

Then look for its log output in damon.log:

tail -f /var/log/daemon.log

For the server, you can e.g. raise rpc.svcgssd log level in /etc/default/nfs-kernel-server:

RPCSVCGSSDOPTS="-vvv"

Browse the /etc/init.d/nfs-* init scripts to see other variables that you can set in /etc/defaults.

If using Kerberos, enable logging in /etc/krb5.conf:

[logging]
     kdc = SYSLOG:INFO:DAEMON
     admin_server = SYSLOG:INFO:DAEMON
     default = SYSLOG:INFO:DAEMON

It's possible to increase verbosity in /etc/idmapd.conf . It can be useful to study the sources for better understandig error messages:

apt-get source nfs-common nfs-kernel-server libgssapi2-heimdal librpcsecgss3 libnfsidmap2


CategoryNetworking

NFSv4Howto (last edited 2017-09-13 15:46:39 by ckimes)