Software >> OS >> Unix >> Linux >> RHEL >> 7 >> RHCE >> Section 6 - NFS
Provide network shares to specific clients
|
/etc/exports |
/test1 192.168.0.20(rw,no_root_squash) |
## what are the NFS sharing options available
rw: Share as read-write. Keep in mind that normal Linux permissions still apply. (Note that this is a default option.)ro: Share as read-only.sync: File data changes are made to disk immediately, which has an impact on performance, but is less likely to result in data loss. On some distributions this is the default.async: The opposite of sync; file data changes are made initially to memory. This speeds up performance but is more likely to result in data loss. On some distributions this is the default.root_squash: Map the root user and group account from the NFS client to the anonymous accounts, typically either the nobody account or the nfsnobody account. See the next section, “User ID Mapping,” for more details. (Note that this is a default option.)no_root_squash: Map the root user and group account from the NFS client to the local root and group accounts.
[root@rhel7server1 ~]# exportfs -avr
exporting 192.168.0.20:/test2
exporting 192.168.0.20:/test1
[root@rhel7server1 ~]# cat /var/lib/nfs/etab
/test2 192.168.0.20(ro,sync,wdelay,hide,nocrossmnt,secure,root_squash,no_all_squash,no_subtree_check,secure_locks,
acl,no_pnfs,anonuid=65534,anongid=65534,sec=sys,secure,root_squash,no_all_squash)
/test1 192.168.0.20(rw,sync,wdelay,hide,nocrossmnt,secure,no_root_squash,no_all_squash,no_subtree_check,secure_locks,
acl,no_pnfs,anonuid=65534,anongid=65534,sec=sys,secure,no_root_squash,no_all_squash)
### Client Installation and Configuration
## install required packages
[root@rhel7client1 ~]# yum -y install nfs-utils
[root@rhel7client1 ~]# systemctl enable rpcbind
[root@rhel7client1 ~]# systemctl start rpcbind
## create mountpoint directories
[root@rhel7client1 ~]# mkdir /test1 /test2
## mount the NFS shares
[root@rhel7client1 ~]# mount -t nfs -o rw rhel7server1:/test1 /test1
[root@rhel7client1 ~]# mount -t nfs -o ro rhel7server1:/test2 /test2
## verify
[root@rhel7client1 ~]# df -h /test1 /test2
Filesystem Size Used Avail Use% Mounted on
rhel7server1:/test1 46G 8.5G 37G 19% /test1
rhel7server1:/test2 46G 8.5G 37G 19% /test2
## ensure NFS shares mounted on reboot
[root@rhel7client1 ~]# vi /etc/fstab
## add following
|
## unmount the NFS shares
[root@rhel7client1 ~]# umount /test1
[root@rhel7client1 ~]# umount /test2
## validate the fstab
[root@rhel7client1 ~]# mount -a
[root@rhel7client1 ~]# df -h /test1 /test2
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/rhel-root 46G 8.5G 37G 19% /
/dev/mapper/rhel-root 46G 8.5G 37G 19% /
Provide network shares suitable for group collaboration
|
|
Use Kerberos to control access to NFS network shares
|
/etc/exports |
/krbdata rhel7client1.myexample.com(rw,no_root_squash,sec=krb5) |
## Note the following options for "sec" paramter as per RHEL7 documentation:
## validate
[root@rhel7server1 ~]# exportfs -avr
exporting rhel7client1.myexample.com:/krbdata
[root@rhel7server1 ~]# showmount -e localhost
Export list for localhost:
/krbdata rhel7client1.myexample.com
## reboot the NFS server for consistent behaviour
### Test from NFS client (rhel7client1.myexample.com)
## Assuming that the machine have been configured as NFS client as described here
## connect to kadmin and add the nfs service principal for this client
[root@rhel7client1 ~]# kadmin
Authenticating as principal root/admin@MYEXAMPLE.COM with password.
Password for root/admin@MYEXAMPLE.COM:
kadmin: addprinc -randkey nfs/rhel7client1.myexample.com
WARNING: no policy specified for nfs/rhel7client1.myexample.com@MYEXAMPLE.COM; defaulting to no policy
Principal "nfs/rhel7client1.myexample.com@MYEXAMPLE.COM" created.
kadmin: ktadd nfs/rhel7client1.myexample.com
Entry for principal nfs/rhel7client1.myexample.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal nfs/rhel7client1.myexample.com with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal nfs/rhel7client1.myexample.com with kvno 2, encryption type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal nfs/rhel7client1.myexample.com with kvno 2, encryption type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal nfs/rhel7client1.myexample.com with kvno 2, encryption type camellia256-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal nfs/rhel7client1.myexample.com with kvno 2, encryption type camellia128-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal nfs/rhel7client1.myexample.com with kvno 2, encryption type des-hmac-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal nfs/rhel7client1.myexample.com with kvno 2, encryption type des-cbc-md5 added to keytab FILE:/etc/krb5.keytab.
kadmin: quit
## enable and start nfs-client.target
[root@rhel7client1 ~]# systemctl enable nfs-client.target
[root@rhel7client1 ~]# systemctl start nfs-client.target
## create mountpoint directory
[root@rhel7client1 ~]# mkdir /mnt/krbdata
## Verify - mount using nfs4
[root@rhel7client1 ~]# mount -t nfs4 -o sec=krb5 rhel7server1.myexample.com:/krbdata /mnt/krbdata
[root@rhel7client1 ~]# df -h /mnt/krbdata
Filesystem Size Used Avail Use% Mounted on
rhel7server1.myexample.com:/krbdata 85G 5.6G 80G 7% /mnt/krbdata
## become user krbtest
[root@rhel7client1 ~]# su - krbtest
Last login: Wed Jun 17 15:02:41 +08 2020 on pts/0
## test cd to the NFS mount point without Kerberos token, you will get Permission denied error
[krbtest@rhel7client1 ~]$ cd /mnt/krbdata
-bash: cd: /mnt/krbdata: Permission denied
## run kinit to obtain the Kerberos token for user krbtest
[krbtest@rhel7client1 ~]$ kinit
Password for krbtest@MYEXAMPLE.COM:
[krbtest@rhel7client1 ~]$ cd /mnt/krbdata
[krbtest@rhel7client1 krbdata]$ touch krbtest.txt
[krbtest@rhel7client1 krbdata]$ ls -l
total 0
-rw-rw-r--. 1 krbtest krbtest 0 Jun 17 15:21 krbtest.txt
## now the user is allowed to cd to the NFS mount point and can write a file to it.
References
1. https://www.lisenet.com/2016/kerberised-nfs-server-on-rhel-7/