Documentation

A nice talk about NFS security was held at CCC by Sergej Schmidt.

Cheatsheet

Display available NFS shares

Display all available NFS shares from a server on a remote machine:

showmount -e <server_ip>

Troubleshooting

Applications or programs accessing NFS shares stall or do not start

When a NFS share is mounted on a client to serve as storage for appdata of Docker containers for instance it is abvisable to change the defaults settings of the mount - not like in the above example. These options in etc/fstab can be a starting point:

nolock,soft,rw

NFS shares can not be mounted during startup on Linux machines

When a NFS share shall be mounted on a Linux client it may help to add the option _netdev to mount the share during boot. This option speicifies that the mount is dependent on the network and will schedule it after the network interface is up and running. See the Arch Linux fstab documentation for more info.

NFS share is not mounted during boot

If your have defined a NFS share in the /etc/fstab but it is not mounted during boot try out following options:

_netdev,noauto,x-systemd.automount

The option noauto prevents the share to be mounted at boot, since this seems to fail - probalby because the network driver is not yet loaded. The option _netdev tells the system that the mount if dependent on the network being available. The option x-systemd.automount tells systemd to automatically mount the share when it is accessed.

With all these options it should be available to mitigate problems with the availability of the network during boot, so that the corresponding NFS share is available after startup.


NFS V3 vs. V4

Source:

The version V3 manages the user permission rights solely based in UIDs and GIDs, whereas the V4 implementation is able to work out permission rights based on domain names.

Generally for small networks it is easier to use the UID based permission management, since it is easy to set up UIDs on all used machines corresponding to NFS share. This means that the shared directories on the server must have the same owner UID as the user that is mounting the share on the client machine. Itherwise only root users will have access to the share if the -maproot option is correctly set up and the root UID of server and client match.

Export NFS share

To export a NFS share the exports configuration file has to be adjusted. On a FreeBSD server the /etc/exports file could look something like this:

V4: /data
/data/testshare -maproot=0:10

This specific configuration will share the testshare directory with NFS V4 of the data share and map UIDs 0 to 10 to the root user. This means all users that share the UID of the owner of the files inside the share and all root UIDs can edit the share files.

This means if you want non-root users to edit files in a share, it is necessary that UIDs of the file owner on the server and client match.

Export in FreeBSD

To setup a NFS share on a FreeBSD server take a look at Setting up NFS shares.

Info

Make sure to setup the nfs_server_flags correctly on FreeBSD machines, otherwise the NFS shares will cause problems if they are used for appdata storage of Docker containers or similar. Start with the exemplary configuration in Setting up NFS shares.

Mount NFS share

Source: https://www.server-world.info/en/note?os=Fedora_35&p=nfs&f=2

A directory of a server can be mounted via NFS. This can be done using the following commands if all prerequisites are installed on the client machine.

Prerequisites

Fedora

On Fedora the nfs-utils have to be installed on the client machine.

Debian

On Debian the tool nfs-kernel-server has to be installed on the client machine

Mount the drive

A network drive can be mounted with the following command:

sudo mount -t nfs <remote_ip>:<remote_directory> <local_directory>

To mount this share always after startup add a line to /etc/fstab:

<remote_ip>:<remote_directory> <absolute_local_directory> nfs defaults 0 0

To unmount this share again use the following command:

sudo umount <local_directory>    

Info

When a NFS share is mounted on a client to serve as storage for appdata of Docker containers for instance it is abvisable to change the defaults settings of the mount - not like in the above example. These options in etc/fstab can be a starting point:

nolock,soft,rw

Info

When a NFS share shall be mounted on a Linux client it may help to add the option _netdev to mount the share during boot. This option speicifies that the mount is dependent on the network and will schedule it after the network interface is up and running. See the Arch Linux fstab documentation for more info.