Tag Info

Hot answers tagged

3

To clarify, is 'john' the technophobe? If so then change the su configuration and sudo configuration to always ask for the users password (even if you are root) before switching users. If the users have thwarted the system and given themselves sudo, then theres a few problems here. NFSv3 and AUTH_SYS (the basic mechanism used for identifying users) is ...


3

You can do this by using policy-based routing to hint to Linux to prefer particular interfaces for specific traffic. However, the setup you're using here looks very unstable and you're going to HAVE LOTS OF PAIN in the future.


2

A generic keytab is no use at all - the Kerberos Service Principle is tied to hostname. So a generic keytab simply won't work. You don't necessarily need an NFS specific key - depending which OS version you're using. We can use HOST/full.qualified.hostname to authenticate NFS on RHEL 6+. So yes, you do need a keytab on each machine. I know that's horrible, ...


2

This is quite a broad question, and a bit depends on e.g. NFS versions. However: NFS allows you to specify a security mode on export. It also allows you to apply limits to which servers may mount your export. (Either limiting mounting at all, or enforcing read only/no root). This is nothing at all to do with permissions. If your security mode is 'sys' ...


2

No, this is not possible. NFS is providing a network mount and is outside of the block-device scheduler settings.


2

It only seems to edit the file to insert placemarkers. I'd submit a ticket on Github and say that you'd like the behaviour changed, see what response you get. EDIT: Was feeling generous - https://github.com/mitchellh/vagrant/issues/4148 :)


2

What do the logs on the other side say? I suspect the other side is having a problem (the file system is full, doesn't support large files, etc.) According to /usr/include/errno.h (http://stackoverflow.com/questions/503878/how-to-know-what-the-errno-means) #define EBUSY 16 /* Device or resource busy */ NFS errors and errno.h codes are only the ...


2

As suggested by others you can add static routes route add -host 10.10.10.5 dev eth1 and verfiy with route -n


2

Answer A8 of the Linux NFS FAQ has an explanation. A summary: it's up to the client to poll the server to ask for changes (by checking file attributes to see if they've changed since last time the client checked). Clients traditionally do that at regular intervals, but also any time they open a file. They also flush back any writes or close. This means ...


1

Now we've got it working (-fstype=nfs is not needed, and probably not valid, in a map) your question betrays a misunderstanding about how automount presents to the user. Here's an automount entry in my master file /mnt /etc/auto.master.d/mnt and the corresponding map # cat /etc/auto.master.d/mnt helvellyn -ro,soft,intr ...


1

I have written code to solve your problem, but it won't work for everybody. The problem is that you have to figure out some way to extend trust to untrusted hardware. Every site will have a slightly different way to do that. I use an ssh key that is installed by our configuration management to extend trust to untrusted machines. The code I wrote is in ...


1

Does your export utilize root_squash? From the CentOS docs: root_squash — Prevents root users connected remotely from having root privileges and assigns them the user ID for the user nfsnobody. This effectively "squashes" the power of the remote root user to the lowest local user, preventing unauthorized alteration of files on the remote server. ...


1

This is a problem with special characters in the file names, as discussed here: http://superuser.com/questions/91967/rsync-character-set-problems


1

regarding the type:=program mount/unmount commands, the infodoc for amd on OpenBSD mentions that the first element in the argument is the program to execute, and the second arg is what gets passed in as $0. so iow, if i did mount:="/sbin/mount_nfs -x10 -3 -dt600 -r32768 -w32768 -o rw,tcp.intr host:/path/${key} /local/${key}" i ended up getting: ...


1

Something that worked for me in my particular setup, to get cleints working, was this: I had an autofs tree with a mounted nfs fs on /fs/doom and another mounted on /fs/doom/localvol5. After server reboot it was possible to access /fs/doom and /fs/doom/localvol5/sub, but /fs/doom/localvol5 itself gave ESTALE on everything, including umount -f, -l, -fl. ...


1

A little late, but maybe it helps nevertheless. A bindmount to some other folder (outside your NFS mount) is your friend. I just tried it sucessfully. mount -o bind /tmp/.johndoe_puls /home/johndoe/.puls Of course, this can only be done by the root user. The mountpoint of the bindmount gets the same permission set as the mount target. Regards, Jörn


1

I post an answer because >50 reputation is needed to comment. I'm going to point you to this very good article in case you haven't stumbled upon it. Also, there's this very interesting line: Alternatively, you can change your service that needs the network to be up, to include After=network-online.target and Wants=network-online.target Please note ...


1

I have the same problem and I found a post here saying: NFS server has an option of working in insecure mode (Allowing higher incoming port numbers). Windows NFS client often uses higher port numbers. You can enable this option by adding an option to the share Example: /share *(insecure,rw) You can also try installing Windows services for UNIX ...


1

please check if following solutions sourced from the gentoo forum help you: 1. On the NFS server, /etc/hostname did not contain the FQDN, just the local hostname. 2. This particular client had an unconfigured /etc/idmapd.conf. It had Domain = localdomain instead of Domain = FQDN-minus-hostname. For your setup this looks like the 2nd option. google for ...


1

I'm going to take a bit of a guess. If you resolve UID '0' or '500' on your NFS server, what do you get? Are they local accounts by any chance? The reason I suggest that, is that NFSv4 by design, references account names within a domain, and tries to avoid the 'local authentication' thing from previous versions of NFS. It therefore uses idmapd, which ...


1

You have four choices, none of which are easy for the situation you're in. Fix it at the server level Ban every workstation under the purview of the person violating your security policy. What's the point of security otherwise? Fix it at the client level Take away root. Period. Anything short of this is a paper thin sleight of hand that will be worked ...



Only top voted, non community-wiki answers of a minimum length are eligible