I'm trying to configure NFS between two RHEL7 nodes:

first node:

[root@ip-10-164-175-246 ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.0 (Maipo)
[root@ip-10-164-175-246 ~]# rpm -q nfs-utils
nfs-utils-1.3.0-0.el7.x86_64
[root@ip-10-164-175-246 ~]# cat /etc/exports
/var/www/html/  ip-10-184-161-46.ec2.internal(rw)
[root@ip-10-164-175-246 ~]# 

second node:

[root@ip-10-184-161-46 ~]# mount ip-10-164-175-246.ec2.internal:/var/www/html/ /mnt/
[root@ip-10-184-161-46 ~]# touch /mnt/$$
touch: cannot touch ‘/mnt/3326’: Permission denied
[root@ip-10-184-161-46 ~]# 

Why can't I write anything to /mnt/ over NFS?

  • 1
    Try changing the (rw) in /etc/exports to (rw,no_root_squash), doing an exportfs -av on the server, then remount the filesystem on the client and try again. – MadHatter Jul 8 '14 at 16:39
up vote 23 down vote accepted

Does your export utilize root_squash? From the CentOS docs:

root_squash — Prevents root users connected remotely from having root privileges and assigns them the user ID for the user nfsnobody. This effectively "squashes" the power of the remote root user to the lowest local user, preventing unauthorized alteration of files on the remote server. Alternatively, the no_root_squash option turns off root squashing. To squash every remote user, including root, use the all_squash option. To specify the user and group IDs to use with remote users from a particular host, use the anonuid and anongid options, respectively. In this case, a special user account can be created for remote NFS users to share and specify (anonuid=,anongid=), where is the user ID number and is the group ID number.

You'll need to add the flag no_root_squash to disable this, as it's on by default.

  • 1
    Thanks, everything works as expected! I was missing no_root_squash, Thanks again! – alexus Jul 8 '14 at 16:52
  • I found that article on the RHEL websites: access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/… . It seems it's not secure at all to use no_root_squash. What is the solution if we want to follow their recommendations? – Djidiouf May 20 '16 at 0:25
  • You'll basically want to give the 'nobody' user the ability to modify the appropriate files on the NFS mount. When the Root user is mapped (squashed) to nobody, it will still be able to modify them. Alternately, I believe NFSv4 allows you to define proper local/server account mappings. – Christopher Karel May 23 '16 at 20:48

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.