NFS Server Conf in Security Patch
NFS Server Conf in Security Patch
NFS allows a Linux server to share directories with other UNIX clients over
network. NFS server exports a directory and NFS client mounts this directory.
RHEL 7 supports two version of NFS – NFSv3 and NFSv4.
RHEL7 provides the support for NFS versions 3, 4.0, and 4.1(latest version)
NFS default port number is 2049
NFS share we can mount Manually, Automatically using AutoFS 1
Important Services
rpcbind : The rpcbind server converts RPC program numbers into universal
addresses.
nfs-lock / rpc-statd : NFS file locking. Implement file lock recovery when an NFS
server crashes and reboots.
nfs-idmap : It translates user and group ids into names, and to translate user and
group names
2
into ids
• Remote Procedure Call (RPC)
• RPC, defined by RFC 1057, is a set of function calls used by a client program to call functions in a
remote server program. The port mapper program is the program used to keep track of which ports
programs supporting RPC functions use. The port mappers port is 111. In Redhat Linux the
portmapper daemon is started in the /etc/rc.d/init.d/portmap and the daemon program is called
"portmap".
The rpcinfo command
The command "rpcinfo -p" will show the port numbers that are assigned to the RPC services.
Because RPC-based services rely on rpcbind to make all connections with incoming client
requests, rpcbind must be available before any of these services start. Command - rpcinfo -p
Starting the nfs-server process starts the NFS server and other RPC processes. RPC
processes includes:
– rpc.statd : implements monitoring protocol (NSM) between NFS client and NFS server
– rpc.mountd : NFS mount daemon that implements the server side of the mount requests from
NFSv3 clients.
4
– rpc.idmapd : Maps NFSv4 names and local UIDs and GIDs
– rpc.rquotad : provides user quota information for remote users.
5
6
7
Let's have a look now at how NFS works:
A client may request to mount a directory from a remote host on a local directory
just the same way it can mount a physical device. However, the syntax used to
specify the remote directory is different. For example, to mount /home from host
vlager to /users on vale, the administrator would issue the following command on
vale:
mount will then try to connect to the mountd mount daemon on vlager via RPC. The
server will check if vale is permitted to mount the directory in question, and if so,
return it a file handle. This file handle will be used in all subsequent requests to files
below /users.
When someone accesses a file over NFS, the kernel places an RPC call to nfsd (the
NFS daemon) on the server machine. This call takes the file handle, the name of the
file to be accessed, and the user's user and group id as parameters. These are used in
determining access rights to the specified file. In order to prevent unauthorized users8
from reading or modifying files, user and group ids must be the same on both hosts.
Let's have a look now at how NFS works:
A stateless protocol does not require the server to retain session information
or status about each communicating partner for the duration of multiple
requests. In contrast, a protocol that requires keeping of the internal state on
the server is known as a stateful protocol. A TCP connection-oriented session is
a 'stateful' connection because both systems maintain information about the
9
session itself during its life.
10
Features:
File / Folder sharing between *nix systems
Allows to mount remote filesystems locally
Can be acted as Centralized Storage system
It can be used as a Storage Domain ( Datastore) for VMware and other Virtualization
Platform.
Allows applications to share configuration and data files with multiple nodes.
Allows to have updated files across the share.
Server Profile:
Packages: nfs-utils rpcbind
Daemon Name: nfs-service
Port Number: 2049
Config file path: /etc/exports, /etc/sysconfig/nfs 11
NFS server side configuration
Step 1 :Install nfs packages through yum command.
Step 2 : Start the NFS services and enable the services to work even after reboots
/etc/exports : It is a main configuration file, controls which file systems are exported
to remote hosts and specifies options.
sync : all changes to the according filesystem are immediately flushed to disk; the
respective write operations are being waited for.
13
Important Configuration Files:
•no_root_squash : By default, any file request made by user root on the client
machine is treated as by user nobody on the server. (Exactly which UID the
request is mapped to depends on the UID of user “nobody” on the server, not the
client.) If no_root_squash is selected, then root on the client machine will have
the same level of access to the files on the system as root on the server.
•/etc/fstab : This file is used to control what file systems including NFS directories
are mounted when the system boots.
•/etc/sysconfig/nfs : This file is used to control which ports the required RPC
services run on.
14
Few Commands
15
Soft Mounting in NFS
Suppose you have once process on your client machine, say for example, an
Apache web server is accessing a mounted share and files in it. But due to some
problem on the NFS server, the request made by Apache for a file on the NFS
share cannot be completed. In this case the NFS client will reply to the process
(Apache in our case), with an error message.
Most of the processes will accept the error. But it all depends on how the process
is designed to handle these errors. Sometimes it can cause unwanted behavior
and even can corrupt the files.
The process that is waiting for the operation to get completed, cannot be interrupted.
Yeah sure you can kill the process with a kill -9 command, and can also be
interrupted with the help of an option called intr.
A hard mounting can be done by adding the options as shown below in fstab.
17
192.168.0.105:/data /mnt nfs rw,hard,intr 00
END of this Course Module.
Thanks
18