Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to connect to an NFS folder on my dev server. The owner of the folder on the dev server is darren and group darren.

When I export and mount it to my Mac using the Disk Utility it mounts, but then when I try to open the folder is says I do not have permissions. I have set rw, sync, and no_subtree_check. The user on the Mac is darren with a bunch of groups.

Do I need to have the same group and user set to access the folder?

share|improve this question

3 Answers 3

up vote 13 down vote accepted

When you mount NFS, your permissions you're mounting it with must match up with what you have on the server. For example, if your user has only read-only access, mounting it with read-write will cause you to see the same errors you mentioned in your post when you try to actually load the mount. Unfortunately, this will ONLY show up when accessing the folder, not when you actually mount it.

You also want to make sure that the user NFS is running as on the server and the user on the client are using the same UID and GID. You can check these values by running id darren on both the server and the client. If the UID and GID values to not match up, you can edit /etc/passwd t make it so--but make sure you understand what you're doing before arbitrarily changing values!

Some good sources:

I hope this helps!

share|improve this answer
    
Yeah I shouldn't have tried to change the UID I have to redo my server now. How would one mimic the UID and GID? Is it really this complicated? –  Darren Feb 27 '11 at 20:32
    
Unfortunately, in my experience of using this in the workplace, NFS is extremely fragile, and yes--it can be this complicated. Usually, you'll want a dedicated NFS user with a specif UID/GID on each server/client so that you don't run into this issue. If you have a choice in your dev environment (i.e., it doesn't HAVE to use NFS), looking into using something like SSHFS will make your dev headaches go away--but won't replicate the same functionality as a production server using NFS. –  Andrew M. Feb 27 '11 at 20:35
    
Do you think Samba is another solution? I have used it with Windows with no problem and I am thinking this is the way I will have to go even though I am using a Mac for developing my application. –  Darren Feb 27 '11 at 21:34
    
That's certainly another possibility, if you're willing to set it up. –  Andrew M. Feb 27 '11 at 21:35
    
I would hesitate to say NFS is fragile. It is a long established file service protocol. There are really only two requirements for NFS: synchronized UID/GID among the clients and synchronized time between the clients and server. Traditionally, NIS was used to synchronize user information, but LDAP is a more secure choice for new deployments in the last decade. –  Jeff Strunk Feb 28 '11 at 11:52

Do your UIDs and GIDs match on both servers? That's what it's using to control access and not the login and group name.

share|improve this answer

NFS is built on top of RPC authentication. With NFS version 3, the most common authentication mechanism is AUTH_UNIX. The user id and group id of the client system are sent in each RPC call, and the permissions these IDs have on the file being accessed are checked on the server. For this to work, the UID and GIDs must be the same on the server and the clients. However, you can force all access to occur as a single user and group by combining the all_squash, anonuid, and anongid export options. *all_squash* will map all UIDs and GIDs to the anonymous user, and anonuid and anongid set the UID and GID of the anonymous user. For example, if your UID and GID on your dev server are both 1001, you could export your home directory with a line like

/home/darren 192.168.1.1/24(rw,all_squash,anonuid=1001,anongid=1001)

I'm less familiar with NFS version 4, but I think you can set up rpc.idmapd on the clients to alter the uid and gid they send to the server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.