5

I've run into a strange problem while trying to mount from FreeBSD 9.0-RC3 to a Debian Linux box.

The command I'm using is:

sudo mount -v gorkon:/dustbin /tmp/test

This returns the following immediate information:

mount: no type was given - I'll assume nfs because of the colon mount.nfs: timeout set for Thu Jan 5 17:37:40 2012 mount.nfs: trying text-based options 'vers=4,addr=[serverip],clientaddr=[cllientaddr]' mount.nfs: mount(2): Permission denied mount.nfs: access denied by server while mounting gorkon:/dustbin

There's no log entry that I can find on the server (gorkon), and the following log entry is in my syslog for the debian box:

[30082.224612] RPC: server gorkon requires stronger authentication.

The NFS server has nfsuserd running, rpcbind running. I've tried to set the share in /etc/exports to use sec=sys (and connect the same way). I don't have Kerberos set up on this network, and I'm not about to start. The Debian NFSv4 servers do connect to a Solaris 10 NFSv4 server, and the FreeBSD box can't mount its own shares over NFS if I force use of nfsv4 (error is mount_nfs: /tmp/test, : Permission denied). A FreeBSD 8.2-RELEASE box won't mount either, same error.

The Solaris 10 box also cannot mount the FreeBSD box's mount. The error for this machine is :

genunix: [ID 664466 kern.notice] NFS compound failed for server gorkon: error 7 genunix: [ID 532867 kern.warning] WARNING: NFS server initial call to gorkon failed: permission denied.

NFSv3 mounts work fine.

Any idea what could be going on?

3 Answers 3

3

I had the same problem, make sure you have a "V4:" root line in /etc/exports, like so:

V4: / -sec=sys
/tank/dedup host1 host2 host3
1

Have you specified an authentification type on the FreeBSD Server and on your cmd to mount from it? FreeBSD afaik requires that for NFSv4.

sec=⟨flavor⟩ This option specifies what security flavor should be used for the mount. Currently, they are:

                 krb5 ‐  Use KerberosV authentication
                 krb5i ‐ Use KerberosV authentication and
                         apply integrity checksums to RPCs
                 krb5p ‐ Use KerberosV authentication and
                         encrypt the RPC data
                 sys ‐   The default AUTH_SYS, which uses a
                         uid + gid list authenticator

See mount_nfs(8)

3
  • I've set sec=sys in both exports (tried ZFS attribute and /etc/exports separately) and mounting with -o sec=sys on the client boxes and the server itself. The server just replies with "Permission Denied" from mount_nfs (no entries in dmesg), and the linux client boxes state "access denied by server" and leave a message in the /var/log/messages from RPC regarding the server wanting stronger authentication. NFSv3 seems to work. Jan 24, 2012 at 23:32
  • I've posted a bug report with FreeBSD for now. Jan 24, 2012 at 23:42
  • 1
    Yeah, that may actually be a good guess. I've messed with NFSv4 on FreeBSD when it first came out and had some trouble with this, too. Ultimately I gave up, because there still were some known issues with sec_sys back then. Sadly NFSv4 also is poorly documented imo, so its hard to see if this still is one of those old bugs or ones own fault.
    – juwi
    Jan 25, 2012 at 0:09
1

On the server side in FreeBSD you need the following lines in /etc/rc.conf

nfs_server_enable="YES"
nfsv4_server_enable="YES"
nfsuserd_enable="YES"

and this would be the simplest possible /etc/exports

V4: /
/

On the Debian client end, you want to mount it using NFSv4 like so:

$ sudo mount -t nfs4 test.home:/ /mnt

You want to replace test.home with the IP or hostname of your NFS server, and you can replace /mnt with whatever mount point you want to use.

You can check the protocol used by looking at the output of this command:

$ mount
test.home:/ on /mnt type nfs4 (rw,addr=192.168.1.5,clientaddr=192.168.1.3)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .