4

My NFS server seems to be ignoring secondary groups. I have fewer than 16 groups per user, but have --manage-gids on. The NFS share doesn't mount when this option is missing. Users and groups are managed with LDAP, and authentication is done via Kerberos. My exports are set up like this:

> cat /etc/exports
/srv/nfs4 *(rw,sync,fsid=root,crossmnt,no_subtree_check,sec=krb5i,insecure)
> grep /srv/nfs4 /etc/fstab
/home   /srv/nfs4/home  none    bind    0   0
/var/backups/home   /srv/nfs4/archive   none    bind    0   0
> hostname -f
nfs.example.com

The NFS mount is mounted as follows, both on the server itself and on a few other client machines:

> grep nfs4 /etc/fstab
nfs.example.com:/ /mnt/nfs nfs rw,exec,nfsvers=4 0 0

UIDs are correct, since the NFS filesystem is mounted on the server itself. This also happens when I mount it on another machine.

> id
uid=1027(kai) gid=1027(kai) groups=1027(kai),27(sudo),100(users)
> ls -n /mnt/nfs/home/kai/test
total 0
drwxr-xr-- 1 1001  100 0 Mar 27 11:44 test1/
drwxr-xr-x 1 1001  100 0 Mar 27 11:44 test2/
drwxr-xr-- 1 1001 1027 0 Mar 27 11:44 test3/

In the local directory (/home/kai/test and /srv/nfs4/home/kai/test), I can cd to all of the test directories. In /mnt/nfs/home/kai/test, I cannot cd to test1/. My conclusion is that the group permission (r-x) on the secondary group users is being ignored - any idea why this might be?

Investigation

After investigating some more with wireshark, it seems to be a host-side issue. The client is issuing LOOKUP calls, and getting the expected response (which it should be, since the correct permissions are shown with ls). However, it is not getting the correct response to ACCESS calls - the client sends Check: Read/Lookup/Modify/Extend/Delete and receives Allowed: Read/Lookup for test2 and test3, but only Allowed: Read for test1.

13
  • I'm a bit confused. Your /etc/exports shows that your export is /srv/nfs4 then your fstab shows that you are mounting the root directory of a different machine at /mnt/nfs on the same computer. Can you edit your question to specify the export on the server and the fstab/where your are trying to mount the export on the client? Mar 27, 2018 at 11:30
  • @NasirRiley - almost, the NFS is mounted on the server itself (which I'm calling nfs.example.com here) as well as a few clients. I've split it up to hopefully make it clearer?
    – kai
    Mar 27, 2018 at 12:01
  • Why do you need to mount the export on the server itself? Aren't the users accessing it from their workstations? Wouldn't it make more sense to add an entry to /etc/fstab for the export on their workstations? Mar 27, 2018 at 16:51
  • It is only mounted on the server itself for testing (to exclude the possibility that it is a difference in UID/GID assignment causing the issue). It is also on the users workstations, the problem occurs in both places.
    – kai
    Mar 27, 2018 at 16:56
  • What does the fstab file look like on the workstations? Mar 27, 2018 at 17:30

0

You must log in to answer this question.

Browse other questions tagged .