Tag Info

Hot answers tagged

12

You seem to be asking two questions here: What are we actually using? and What does this? What I'm actually using is CIFS, in my use-cases POSIX is less important so I haven't had any problems. NFS3 is used in areas where security isn't important, such as my SLES install server. And finally, sshfs/gvfs for simple user-land sharing. Wireline encryption is ...


8

Since it's a specific question (What are you all doing), let's answer it: nothing. Most administrators and users just don't worry about NFS security, so everybody uses NFSv3. It's typically a controlled environment (in the sense that only well-known machines can attach to the network in the first place). If somebody gets caught abusing the infrastructure, ...


4

NFS 4.1 (minor 1) is designed to be a faster and more efficient protocol and is recommended over previous versions, especially 4.0. This includes client-side caching, and although not relevant in this scenario, parallel-NFS (pNFS). The major change is that is that the protocol is now stateful. ...


3

I had the same problem, make sure you have a "V4:" root line in /etc/exports, like so: V4: / -sec=sys /tank/dedup host1 host2 host3


3

I've been using openafs in production for years, with both Linux and Windows clients. It works great, has an active development community, and has gotten much easier to install and administer over the last few years as the various linux distros have included packaging for it. It has its warts, but I've found that they are offset by more administrative ...


3

You can remove all non trivial ACLs in ZFS with the following: chmod A- filename Source: Solaris ZFS Administration Guide: Using ACLs and Attributes to Protect ZFS Files


3

Now we've got it working (-fstype=nfs is not needed, and probably not valid, in a map) your question betrays a misunderstanding about how automount presents to the user. Here's an automount entry in my master file /mnt /etc/auto.master.d/mnt and the corresponding map # cat /etc/auto.master.d/mnt helvellyn -ro,soft,intr ...


2

If you set up Quotas in the shared file system (on the server side), the clients can't use more space than the quota set.


2

If you want to limit the amount of disk space each user (or group) is using, then you can set up disk quotas on the NFS server (as mentioned in another answer already). You can easily find tutorials about how to do that. Once disk quotas are enabled, you can set the maximum disk space each user is able to use (the default is not to have any limit, so you ...


2

I see you've set the max values for rsize and wsize, and assuming no network or CPU bottlenecks this is likely the best you're going to get. Certainly NFS is the fastest option for a network mount. You can test the speeds you're getting with various r and w sizes through trial and error. Take a look at http://www.tldp.org/HOWTO/NFS-HOWTO/performance.html ...


2

In RHEL 7, the same SELinux policies that apply to Apache also apply to nginx. So you can use the same booleans: httpd_use_nfs (off , off) Allow httpd to use nfs Set the correct boolean to allow the web server to use NFS. setsebool -P httpd_use_nfs 1


2

res_exportfs_export2_stop_0 on xx.xx.xx.1 'unknown error' (1): call=47, status=Timed Out, last-rc-change='Tue Mar 31 12:53:04 2015', queued=0ms, exec=20003ms Shows that your res_exportfs2 resources failed to stop due to a timeout. It may simply be that it needs a longer timeout. Try configuring a stop timeout for this resource like so: primitive ...


2

I've found the solution: Looking at an strace of the rpc.svcgssd daemon, I saw that the last file opened before the error ways the /etc/krb5.keytab. The keytab on the server was generated using kadmin with a kinit of "kadmin/admin". A kinit -k -t /etc/krb5.keytab nfs/SERVER.example.com@REALM on the SERVER resulted in a invalid password errror. So i ...


2

this turned out to be the clue: rpc.idmapd[5924]: nfsdcb: id '-2' too big! the issue was that the default nfsnobody user has a uid of 4294967294 , but on a 64-bit CentOS system it appears to be interpreting this number in a 32-bit context leading to the infamous -2. The fix is to : change nfsnobody user/group to uid/gid 65534 on both client and server ...


2

Great questions, highlights a bigger point with the documentation IMO. Here is an attempt at a complete answer: What does "subsequent exports on that line only" mean? An example's probably easiest here: /export/stuff -rw 10.0.0.54 10.0.0.55 is equivalent to: /export/stuff 10.0.0.54(rw) 10.0.0.55(rw) Is fsid=0 not required anymore? This depends on ...


2

Somewhere you have a symbolic link that points back to its parent. Use this to find it: find /mnt/storage -type l -exec ls -l {} \; Once you do, then perhaps you can figure out how to correct it.


2

The spammy log messages you see are coming from the ocf:heartbeat:exportfs resource agent. They appear every 30 seconds, which corresponds to the monitoring interval you specified in the exportfs primitive definitions. The resource agent is a bit too verbose, IMHO, but this should not be a problem. Just make sure you logrotate often enough that the logs ...


2

You can use either lsof or ftop (the last one is on EPEL repo) For example: lsof -N /mnt/nfs/* HTH


2

OK. I think I solved this. It seems that I had a "-T" in RPCNFSDCOUNT in /etc/default/nfs-kernel-server. This disables TCP which is required for NFSv4. Removing -T and restarting nfs-kernel-server solves the problem.


2

service is responsible for that is: rpc.idmapd - NFSv4 ID <-> Name Mapper and to restart it you should be using: service rpcidmapd status


1

The fix may require less than this, but this should work: service rpcbind restart service rpcidmapd restart service nfslock restart service netfs restart service nfs restart


1

you need user 'bob' on the client and server. You may enforce server to send numeric IDs by # echo "options nfs nfs4_disable_idmapping=1" >> /etc/modprobe.d/nfs.conf


1

This was resolved via the following setting in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=500778 /etc/idmapd.conf [General] Cache-Expiration = 10 You can visit http://permalink.gmane.org/gmane.linux.nfs/44754


1

I found the cause of this problem. It appears that the NFS v4 ACLs take apply the user's umask. My users had a umask of 002, so the lack of write on others was causing the 'w' 'a' 'd' and 'D' flags to be removed. As far as I can tell this behavior is different to POSIX ACLs. In any case the solution for me was to set the user's umask to 0. In my case one ...


1

The kernel does a up-calls to idmapd daemon to get the mapping. As this is quite expensive operation, the results are cached. To clean the cache run: # nfsidmap -c The command available in RHEL6.3 ( and clones ) and part of the nfs-utils package.


1

Solved the problem after 3 days!! I tried mounting the nfs4 server folder from a client with a newer Kernel version (3.8). I was able to do so. So I copied the configuration file /boot/configure-3.8-generic file to my /usr/src/.config, and enabled the option Filesystems -> Network File Systems -> NFS3 client load as module and NFS4 client load as ...


1

Jun 15 01:31:15 client rpc.gssd[24146]: WARNING: Cryptosystem internal error while getting initial ticket for principal 'nfs/CLIENT.example.com@EXAMPLE.COM' using keytab 'FILE:/etc/krb5.keytab' Can you use kinit to get a tgt using this command ( assumes mit kinit ) kinit -k -t /etc/krb5.keytab nfs/CLIENT.example.com@EXAMPLE.COM I'm guessing ...


1

You are using a syntax marked as DEPRECATED in the exports(5) manpage: RPCSEC_GSS security You may use the special strings "gss/krb5", "gss/krb5i", or "gss/krb5p" to restrict access to clients using rpcsec_gss security. However, this syntax is deprecated; on linux kernels since 2.6.23, you should instead use the "sec=" export option: sec= ...


1

NFSv4 uses utf8 string principals between client and server. As a result, it's sufficient to use the same user names and nfs4 domain on client and server. The uids can be differ. BUT.... If you use AUTH_SYS (mount with sec=sys, which is default) your RPC requests instead of kerberos principal will use uid and gids from the client host. In this case, if uids ...


1

It's clear from debugging a bit that Ubuntu's using rpc.idmap as shipped (up to 12.04, at least). The archaeology: You need a kernel with the nfsidmap mechanism compiled in (the option is 'new' idmap - so I assume it's the replacement of rpc.idmap, therefore) to get the nfsidmap calls to work. Also, ...



Only top voted, non community-wiki answers of a minimum length are eligible