78

I'm trying to connect to an NFS folder on my dev server. The owner of the folder on the dev server is darren and group darren.

When I export and mount it to my Mac using the Disk Utility it mounts, but then when I try to open the folder is says I do not have permissions. I have set rw, sync, and no_subtree_check. The user on the Mac is darren with a bunch of groups.

Do I need to have the same group and user set to access the folder?

Improve this question
0

5 Answers 5

Reset to default
101

NFS is built on top of RPC authentication. With NFS version 3, the most common authentication mechanism is AUTH_UNIX. The user id and group id of the client system are sent in each RPC call, and the permissions these IDs have on the file being accessed are checked on the server. For this to work, the UID and GIDs must be the same on the server and the clients. However, you can force all access to occur as a single user and group by combining the all_squash, anonuid, and anongid export options. all_squash will map all UIDs and GIDs to the anonymous user, and anonuid and anongid set the UID and GID of the anonymous user. For example, if your UID and GID on your dev server are both 1001, you could export your home directory with a line like

/home/darren 192.168.1.1/24(rw,all_squash,anonuid=1001,anongid=1001)

I'm less familiar with NFS version 4, but I think you can set up rpc.idmapd on the clients to alter the uid and gid they send to the server.

Improve this answer
3
  • 11
    I ran across this answer trying to solve an Apple OS X Yosemite nfs issue. This answer is much more relevant and accurate than the accepted answer. It is not advisable nor is it feasible to match UID/GID across systems. A root user on system A is probably not a root user on system B.
    – Allan
    Jul 28, 2015 at 15:32
  • working solution for Ubuntu 20.04 + macOS Big Sur
    – l2ysho
    Nov 7, 2021 at 9:00
  • This helped me when I was having problems with fusermount -u not working to unmount an NFS share I had recently added root_squash to. It's more of an elegant solution for me to squash all requests to a certain UID/GID and now I can use fusermount to unmount it! Thanks.
    – bitofagoob
    Nov 11, 2023 at 9:46
30

When you mount NFS, your permissions you're mounting it with must match up with what you have on the server. For example, if your user has only read-only access, mounting it with read-write will cause you to see the same errors you mentioned in your post when you try to actually load the mount. Unfortunately, this will ONLY show up when accessing the folder, not when you actually mount it.

You also want to make sure that the user NFS is running as on the server and the user on the client are using the same UID and GID. You can check these values by running id darren on both the server and the client. If the UID and GID values do not match up, you can edit /etc/passwd to make it so — but make sure you understand what you're doing before arbitrarily changing values!

Some good sources:

I hope this helps!

Improve this answer
8
  • Yeah I shouldn't have tried to change the UID I have to redo my server now. How would one mimic the UID and GID? Is it really this complicated?
    – Darren
    Feb 27, 2011 at 20:32
  • Unfortunately, in my experience of using this in the workplace, NFS is extremely fragile, and yes--it can be this complicated. Usually, you'll want a dedicated NFS user with a specif UID/GID on each server/client so that you don't run into this issue. If you have a choice in your dev environment (i.e., it doesn't HAVE to use NFS), looking into using something like SSHFS will make your dev headaches go away--but won't replicate the same functionality as a production server using NFS.
    – Andrew M.
    Feb 27, 2011 at 20:35
  • Do you think Samba is another solution? I have used it with Windows with no problem and I am thinking this is the way I will have to go even though I am using a Mac for developing my application.
    – Darren
    Feb 27, 2011 at 21:34
  • That's certainly another possibility, if you're willing to set it up.
    – Andrew M.
    Feb 27, 2011 at 21:35
  • 2
    I would hesitate to say NFS is fragile. It is a long established file service protocol. There are really only two requirements for NFS: synchronized UID/GID among the clients and synchronized time between the clients and server. Traditionally, NIS was used to synchronize user information, but LDAP is a more secure choice for new deployments in the last decade.
    – Jeff Strunk
    Feb 28, 2011 at 11:52
4

Do your UIDs and GIDs match on both servers? That's what it's using to control access and not the login and group name.

Improve this answer
0

Example on how to mount a NFS share on Ubuntu Eoan as a server and MacOS Catalina as a client.

Example assumptions (you need to adapt this):

Client PC name: Bills-MBP

(Press Cmd+Space, start 'terminal', there something like bill@Bills-MBP: is written as a prompt. Use what's written between the @ and the : as client PC name further below).

Username in Ubuntu: tux

(Press the penguin-key on your keyboard, if you have none, order a penguin keyboard sticky and place it over the ugly key with four mis-shaped squares near the space bar. Enter "terminal", start the terminal, the user name will be shown before the @ sign in the prompt. E.g. "tux@dustycray:")

PC name of Ubuntu: dustycray

(Can be found out like shown above.)

Folder on Ubuntu to be shared: /home/tux/mp3

Use whatever folder you need to share as absolute path

On the NFS-Server (Ubuntu EOAN in my case) enter in the terminal (which we opened as shown above):

id -u tux
# remember the number, use it below as anonuid (replace the 1000 there)
id -g tux
# remember the number, use it below as anongid (replace the 1001 there)
sudo nano /etc/exports
# At the end of the file add the following line, replace the path name, the Client PC Name and the two numbers with your values:
/home/tux/mp3 Bills-MBP(rw,sync,insecure,all_squash,anonuid=1000,anongid=1001)
#leave with ctrl+x and confirm file saving
sudo exportfs -ra

Now on the mac, open a terminal as shown above and enter (leave /private/nfs as it is):

sudo make /private/nfs
#Replace the ubuntu pc name (dustycray) and the path (home ...) by your's now:
sudo mount -t nfs -o resvport,rw dustycray:/home/tux/mp3 /private/nfs

Then the NFS can be accessed in the path /private/nfs. In finder you will see a new entry called (e.g.) "dustycray" on the left in the section "locations", also in file-open dialogs.

Above's mount procedure is not permanent, I use a script to mount it whenever I need it. However, you can also make the mount permanent if you like (e.g. System preferences / Users&Groups / Login Items / + / Select any root folder within (!) the NFS share / Add).

Improve this answer
-3

For me the issue was fixed by providing _netdev mounting option on client.

I.e. add this to /etc/fstab:

nfs-server:/   /mnt   nfs4    _netdev,auto  0  0
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .