My NFS server seems to be ignoring secondary groups. I have fewer than 16 groups per user, but have --manage-gids
on. The NFS share doesn't mount when this option is missing. Users and groups are managed with LDAP, and authentication is done via Kerberos. My exports are set up like this:
> cat /etc/exports
/srv/nfs4 *(rw,sync,fsid=root,crossmnt,no_subtree_check,sec=krb5i,insecure)
> grep /srv/nfs4 /etc/fstab
/home /srv/nfs4/home none bind 0 0
/var/backups/home /srv/nfs4/archive none bind 0 0
> hostname -f
nfs.example.com
The NFS mount is mounted as follows, both on the server itself and on a few other client machines:
> grep nfs4 /etc/fstab
nfs.example.com:/ /mnt/nfs nfs rw,exec,nfsvers=4 0 0
UIDs are correct, since the NFS filesystem is mounted on the server itself. This also happens when I mount it on another machine.
> id
uid=1027(kai) gid=1027(kai) groups=1027(kai),27(sudo),100(users)
> ls -n /mnt/nfs/home/kai/test
total 0
drwxr-xr-- 1 1001 100 0 Mar 27 11:44 test1/
drwxr-xr-x 1 1001 100 0 Mar 27 11:44 test2/
drwxr-xr-- 1 1001 1027 0 Mar 27 11:44 test3/
In the local directory (/home/kai/test
and /srv/nfs4/home/kai/test
), I can cd
to all of the test directories. In /mnt/nfs/home/kai/test
, I cannot cd
to test1/
. My conclusion is that the group permission (r-x
) on the secondary group users
is being ignored - any idea why this might be?
Investigation
After investigating some more with wireshark, it seems to be a host-side issue. The client is issuing LOOKUP
calls, and getting the expected response (which it should be, since the correct permissions are shown with ls
). However, it is not getting the correct response to ACCESS
calls - the client sends Check: Read/Lookup/Modify/Extend/Delete
and receives Allowed: Read/Lookup
for test2
and test3
, but only Allowed: Read
for test1
.
/etc/exports
shows that your export is/srv/nfs4
then yourfstab
shows that you are mounting the root directory of a different machine at/mnt/nfs
on the same computer. Can you edit your question to specify the export on the server and the fstab/where your are trying to mount the export on the client?nfs.example.com
here) as well as a few clients. I've split it up to hopefully make it clearer?/etc/fstab
for the export on their workstations?