2

I have a NFS shared folder (storage) that can be accessed by other machines on my network. The right user can read and write files and folder in that storage, but I've created another user and affected the same group as the original user as a secondary group, but when I try to access the data, I get a permission denied.

Here's the full detail:

On the storage server side (Debian 10):

$> cat /etc/exports
/storage 10.0.0.0/16(rw,sync,no_subtree_check)


$> id original_user  # I replaced the real user by "original_user" but the rest (IDs) is the same
uid=1010(original_user) gid=1010(original_user) groups=1010(original_user)

(second user is not on the storage server)

On the client server (Debian 10):

$> cat /etc/auto.storage
storage    -fstype=nfs,rw    storage:/storage

$> cat /etc/auto.master
+auto.master
/var/nfs /etc/auto.storage --ghost

$> id original_user
uid=1010(original_user) gid=1010(original_user) groups=1010(original_user)

$> id second_user
uid=1001(second_user) gid=1001(second_user) groups=1001(second_user),1010(original_user)

As you can see, second_user is on the correct group.

Now, the folder permissions :

$> ls -l /var/nfs/storage/
drwxr-x--- 3 original_user original_user  4096 Jun 23 15:43 data

(Group is read and execute, so everyone in the group original_user should have access to the content of data).

But when I try the following with second_users :

$second_user> ls -l /var/nfs/storage/data/
-bash: cd: /var/nfs/storage/data/: Permission denied

Why is that?

I discovered that Debian adds a --manage-gids on the RPC at /etc/default/nfs-kernel-server:

RPCMOUNTDOPTS="--manage-gids"

I tried commenting it and restart the server, this lead to the nfs storage stopping being available (trying to list /var/nfs/storage on the client hang forever).

What am I missing?

4
  • what is the permission of /var/nfs/storage/data directory?
    – kofemann
    Jun 25, 2020 at 10:13
  • drwxr-x--- 3 original_user original_user, I've shared it. Are you interested in something else?
    – Cyril N.
    Jun 25, 2020 at 10:22
  • you shouldn't comment it out. Just replace with an empty one: RPCMOUNTDOPTS=""
    – kofemann
    Jun 25, 2020 at 19:35
  • Sorry for that late response here. Tried it, but it didn't work unfortunately :/
    – Cyril N.
    Aug 5, 2020 at 15:24

0

You must log in to answer this question.

Browse other questions tagged .