Tag Info

Hot answers tagged

12

You seem to be asking two questions here: What are we actually using? and What does this? What I'm actually using is CIFS, in my use-cases POSIX is less important so I haven't had any problems. NFS3 is used in areas where security isn't important, such as my SLES install server. And finally, sshfs/gvfs for simple user-land sharing. Wireline encryption is ...


8

Since it's a specific question (What are you all doing), let's answer it: nothing. Most administrators and users just don't worry about NFS security, so everybody uses NFSv3. It's typically a controlled environment (in the sense that only well-known machines can attach to the network in the first place). If somebody gets caught abusing the infrastructure, ...


4

NFS 4.1 (minor 1) is designed to be a faster and more efficient protocol and is recommended over previous versions, especially 4.0. This includes client-side caching, and although not relevant in this scenario, parallel-NFS (pNFS). The major change is that is that the protocol is now stateful. ...


3

I had the same problem, make sure you have a "V4:" root line in /etc/exports, like so: V4: / -sec=sys /tank/dedup host1 host2 host3


3

I've been using openafs in production for years, with both Linux and Windows clients. It works great, has an active development community, and has gotten much easier to install and administer over the last few years as the various linux distros have included packaging for it. It has its warts, but I've found that they are offset by more administrative ...


3

You can remove all non trivial ACLs in ZFS with the following: chmod A- filename Source: Solaris ZFS Administration Guide: Using ACLs and Attributes to Protect ZFS Files


3

Now we've got it working (-fstype=nfs is not needed, and probably not valid, in a map) your question betrays a misunderstanding about how automount presents to the user. Here's an automount entry in my master file /mnt /etc/auto.master.d/mnt and the corresponding map # cat /etc/auto.master.d/mnt helvellyn -ro,soft,intr ...


3

One solution to this issue is to use pam_mkhomedir to create their home directory on their first login to a system. The description in the manpage: The pam_mkhomedir PAM module will create a users home directory if it does not exist when the session begins. This allows users to be present in central database (such as NIS, kerberos or LDAP) ...


2

Here are a few ways of doing this but I'd shy away from using the term "best practice". Cron Job This will work - I've done it before. Why wouldn't it work? Make it run periodically during business hours and warn new users that their account will be ready for use after X minutes. Properly centralise account management Create a script/interface that uses ...


2

I have solved the problem. I'm posting a reply here in case someone else faces the same issue. The solution was very simple. I needed to make sure that the cross-realm authentication principals were created with a single encoding type, of type rc4-hmac: addprinc -e rc4-hmac krbtgt/AD.EXAMPLE.COM@EXAMPLE.COM addprinc -e rc4-hmac ...


2

I've found the solution: Looking at an strace of the rpc.svcgssd daemon, I saw that the last file opened before the error ways the /etc/krb5.keytab. The keytab on the server was generated using kadmin with a kinit of "kadmin/admin". A kinit -k -t /etc/krb5.keytab nfs/SERVER.example.com@REALM on the SERVER resulted in a invalid password errror. So i ...


2

If you set up Quotas in the shared file system (on the server side), the clients can't use more space than the quota set.


2

If you want to limit the amount of disk space each user (or group) is using, then you can set up disk quotas on the NFS server (as mentioned in another answer already). You can easily find tutorials about how to do that. Once disk quotas are enabled, you can set the maximum disk space each user is able to use (the default is not to have any limit, so you ...


2

I see you've set the max values for rsize and wsize, and assuming no network or CPU bottlenecks this is likely the best you're going to get. Certainly NFS is the fastest option for a network mount. You can test the speeds you're getting with various r and w sizes through trial and error. Take a look at http://www.tldp.org/HOWTO/NFS-HOWTO/performance.html ...


2

In RHEL 7, the same SELinux policies that apply to Apache also apply to nginx. So you can use the same booleans: httpd_use_nfs (off , off) Allow httpd to use nfs Set the correct boolean to allow the web server to use NFS. setsebool -P httpd_use_nfs 1


2

res_exportfs_export2_stop_0 on xx.xx.xx.1 'unknown error' (1): call=47, status=Timed Out, last-rc-change='Tue Mar 31 12:53:04 2015', queued=0ms, exec=20003ms Shows that your res_exportfs2 resources failed to stop due to a timeout. It may simply be that it needs a longer timeout. Try configuring a stop timeout for this resource like so: primitive ...


2

I found the cause of this problem. It appears that the NFS v4 ACLs take apply the user's umask. My users had a umask of 002, so the lack of write on others was causing the 'w' 'a' 'd' and 'D' flags to be removed. As far as I can tell this behavior is different to POSIX ACLs. In any case the solution for me was to set the user's umask to 0. In my case one ...


2

Somewhere you have a symbolic link that points back to its parent. Use this to find it: find /mnt/storage -type l -exec ls -l {} \; Once you do, then perhaps you can figure out how to correct it.


2

The spammy log messages you see are coming from the ocf:heartbeat:exportfs resource agent. They appear every 30 seconds, which corresponds to the monitoring interval you specified in the exportfs primitive definitions. The resource agent is a bit too verbose, IMHO, but this should not be a problem. Just make sure you logrotate often enough that the logs ...


2

You can use either lsof or ftop (the last one is on EPEL repo) For example: lsof -N /mnt/nfs/* HTH


2

OK. I think I solved this. It seems that I had a "-T" in RPCNFSDCOUNT in /etc/default/nfs-kernel-server. This disables TCP which is required for NFSv4. Removing -T and restarting nfs-kernel-server solves the problem.


2

service is responsible for that is: rpc.idmapd - NFSv4 ID <-> Name Mapper and to restart it you should be using: service rpcidmapd status


2

this turned out to be the clue: rpc.idmapd[5924]: nfsdcb: id '-2' too big! the issue was that the default nfsnobody user has a uid of 4294967294 , but on a 64-bit CentOS system it appears to be interpreting this number in a 32-bit context leading to the infamous -2. The fix is to : change nfsnobody user/group to uid/gid 65534 on both client and server ...


2

Great questions, highlights a bigger point with the documentation IMO. Here is an attempt at a complete answer: What does "subsequent exports on that line only" mean? An example's probably easiest here: /export/stuff -rw 10.0.0.54 10.0.0.55 is equivalent to: /export/stuff 10.0.0.54(rw) 10.0.0.55(rw) Is fsid=0 not required anymore? This depends on ...


1

I don't think udp has been the default transport for many years, unless you are a sophisticated user with a good understanding I would suggest removing that option, or switching explicitly back to more reliable TCP. You might also want to add the options from your /etc/exports file to your question for reference, and also any configuration options from ...


1

I had the same issue on 2 NFSv4 clients and it was related to some files and directories having unknown uid and gid. Those files had been copied from an old server with a completely different list of users. On the nfs server they will show up with a numeric uid/gid. But on the clients, idmapd maps those to the user nobody and group nogroup but issue the ...


1

Have you specified an authentification type on the FreeBSD Server and on your cmd to mount from it? FreeBSD afaik requires that for NFSv4. sec=⟨flavor⟩ This option specifies what security flavor should be used for the mount. Currently, they are: krb5 ‐ Use KerberosV authentication ...


1

On the server side in FreeBSD you need the following lines in /etc/rc.conf nfs_server_enable="YES" nfsv4_server_enable="YES" nfsuserd_enable="YES" and this would be the simplest possible /etc/exports V4: / / On the Debian client end, you want to mount it using NFSv4 like so: $ sudo mount -t nfs4 test.home:/ /mnt You want to replace test.home with ...


1

you need nfs4 acls, not posix acls. As far as I know, no linux nfs server provides that yet. The easies way to get it is to get a zfs enabled system, like nexentastor. If you have a Netapp filer that one works great too.


1

Later versions of OpenVZ do support NFS4 in container. We are using the latest CentOS 6.2 together with the latest stable OpenVZ release 2.6.32-042stab053.5 and NFS4 do work well for us.



Only top voted, non community-wiki answers of a minimum length are eligible