Tag Info

Hot answers tagged

12

You seem to be asking two questions here: What are we actually using? and What does this? What I'm actually using is CIFS, in my use-cases POSIX is less important so I haven't had any problems. NFS3 is used in areas where security isn't important, such as my SLES install server. And finally, sshfs/gvfs for simple user-land sharing. Wireline encryption is ...


8

Since it's a specific question (What are you all doing), let's answer it: nothing. Most administrators and users just don't worry about NFS security, so everybody uses NFSv3. It's typically a controlled environment (in the sense that only well-known machines can attach to the network in the first place). If somebody gets caught abusing the infrastructure, ...


4

NFS 4.1 (minor 1) is designed to be a faster and more efficient protocol and is recommended over previous versions, especially 4.0. This includes client-side caching, and although not relevant in this scenario, parallel-NFS (pNFS). The major change is that is that the protocol is now stateful. ...


3

I had the same problem, make sure you have a "V4:" root line in /etc/exports, like so: V4: / -sec=sys /tank/dedup host1 host2 host3


3

You can remove all non trivial ACLs in ZFS with the following: chmod A- filename Source: Solaris ZFS Administration Guide: Using ACLs and Attributes to Protect ZFS Files


3

I've been using openafs in production for years, with both Linux and Windows clients. It works great, has an active development community, and has gotten much easier to install and administer over the last few years as the various linux distros have included packaging for it. It has its warts, but I've found that they are offset by more administrative ...


2

this turned out to be the clue: rpc.idmapd[5924]: nfsdcb: id '-2' too big! the issue was that the default nfsnobody user has a uid of 4294967294 , but on a 64-bit CentOS system it appears to be interpreting this number in a 32-bit context leading to the infamous -2. The fix is to : change nfsnobody user/group to uid/gid 65534 on both client and server ...


2

Great questions, highlights a bigger point with the documentation IMO. Here is an attempt at a complete answer: What does "subsequent exports on that line only" mean? An example's probably easiest here: /export/stuff -rw 10.0.0.54 10.0.0.55 is equivalent to: /export/stuff 10.0.0.54(rw) 10.0.0.55(rw) Is fsid=0 not required anymore? This depends on ...


2

You can use either lsof or ftop (the last one is on EPEL repo) For example: lsof -N /mnt/nfs/* HTH


2

The spammy log messages you see are coming from the ocf:heartbeat:exportfs resource agent. They appear every 30 seconds, which corresponds to the monitoring interval you specified in the exportfs primitive definitions. The resource agent is a bit too verbose, IMHO, but this should not be a problem. Just make sure you logrotate often enough that the logs ...


2

Somewhere you have a symbolic link that points back to its parent. Use this to find it: find /mnt/storage -type l -exec ls -l {} \; Once you do, then perhaps you can figure out how to correct it.


2

Now we've got it working (-fstype=nfs is not needed, and probably not valid, in a map) your question betrays a misunderstanding about how automount presents to the user. Here's an automount entry in my master file /mnt /etc/auto.master.d/mnt and the corresponding map # cat /etc/auto.master.d/mnt helvellyn -ro,soft,intr ...


2

If you set up Quotas in the shared file system (on the server side), the clients can't use more space than the quota set.


2

If you want to limit the amount of disk space each user (or group) is using, then you can set up disk quotas on the NFS server (as mentioned in another answer already). You can easily find tutorials about how to do that. Once disk quotas are enabled, you can set the maximum disk space each user is able to use (the default is not to have any limit, so you ...


2

I see you've set the max values for rsize and wsize, and assuming no network or CPU bottlenecks this is likely the best you're going to get. Certainly NFS is the fastest option for a network mount. You can test the speeds you're getting with various r and w sizes through trial and error. Take a look at http://www.tldp.org/HOWTO/NFS-HOWTO/performance.html ...


1

Have you specified an authentification type on the FreeBSD Server and on your cmd to mount from it? FreeBSD afaik requires that for NFSv4. sec=⟨flavor⟩ This option specifies what security flavor should be used for the mount. Currently, they are: krb5 ‐ Use KerberosV authentication ...


1

you need user 'bob' on the client and server. You may enforce server to send numeric IDs by # echo "options nfs nfs4_disable_idmapping=1" >> /etc/modprobe.d/nfs.conf


1

OK. I think I solved this. It seems that I had a "-T" in RPCNFSDCOUNT in /etc/default/nfs-kernel-server. This disables TCP which is required for NFSv4. Removing -T and restarting nfs-kernel-server solves the problem.


1

Ping is not the most appropriate tool to debug DNS trouble. Indeed, ping does not perform any reverse resolution to check if direct and reverse resolutions match (the purpose is only to send an ICMP packet to the IP address directly resolved from the FQDN parameter). If I were you, I would ensure with host or dig command if direct resolution (host ...


1

This is perfectly normal. It is not supposed to listen on port 2049 on the client. As long as the NFS server is listening on port 2049, the client will pick a high port number to connect to the server on port 2049. Simply try to export a directory on the server, and try to mount it on the client. There is no need for the client to listen on port 2049.


1

I have solved the problem. I'm posting a reply here in case someone else faces the same issue. The solution was very simple. I needed to make sure that the cross-realm authentication principals were created with a single encoding type, of type rc4-hmac: addprinc -e rc4-hmac krbtgt/AD.EXAMPLE.COM@EXAMPLE.COM addprinc -e rc4-hmac ...


1

It's clear from debugging a bit that Ubuntu's using rpc.idmap as shipped (up to 12.04, at least). The archaeology: You need a kernel with the nfsidmap mechanism compiled in (the option is 'new' idmap - so I assume it's the replacement of rpc.idmap, therefore) to get the nfsidmap calls to work. Also, ...


1

NFSv4 uses utf8 string principals between client and server. As a result, it's sufficient to use the same user names and nfs4 domain on client and server. The uids can be differ. BUT.... If you use AUTH_SYS (mount with sec=sys, which is default) your RPC requests instead of kerberos principal will use uid and gids from the client host. In this case, if uids ...


1

I had the same issue on 2 NFSv4 clients and it was related to some files and directories having unknown uid and gid. Those files had been copied from an old server with a completely different list of users. On the nfs server they will show up with a numeric uid/gid. But on the clients, idmapd maps those to the user nobody and group nogroup but issue the ...


1

I don't think udp has been the default transport for many years, unless you are a sophisticated user with a good understanding I would suggest removing that option, or switching explicitly back to more reliable TCP. You might also want to add the options from your /etc/exports file to your question for reference, and also any configuration options from ...


1

I got the following answer to this question from the FreeBSD developer who works on the code for NFS. To disable v2 and v3 connections at the server level the following command needs to be run: sysctl vfs.nfsd.server_min_nfsvers=4 If you want the change to permanent on the system then add the following line to /etc/sysctl.conf: ...


1

so it seems it was the wildcard exports, which, if you read the man page, are not recommended. I'd read that before but for some reason didn't fix it. I still think this is a "bug" and it should work in theory but in practice, it doesn't. Hope this helps others. Example of my new exports file: /nfs server1.a2hosting.com(fsid=0,ro,nohide,no_root_squash) ...


1

While NFS 4 clients do work in an OpenVZ VPS (tested with Proxmox 2.1) if the feature nfs:on is enabled and the nfs module is loaded on the host (i.e. container 0), the name -> UID lookups are always done using the rpc.idmapd running on the host. This means that you need to have the same users in your host /etc/passwd as in your VPS. Furthermore, the ...


1

Later versions of OpenVZ do support NFS4 in container. We are using the latest CentOS 6.2 together with the latest stable OpenVZ release 2.6.32-042stab053.5 and NFS4 do work well for us.


1

you need nfs4 acls, not posix acls. As far as I know, no linux nfs server provides that yet. The easies way to get it is to get a zfs enabled system, like nexentastor. If you have a Netapp filer that one works great too.



Only top voted, non community-wiki answers of a minimum length are eligible