UbuntuHelp:NFSv4Howto
来自Ubuntu中文
 |
点击翻译: |
English |
请不要直接编辑翻译本页，本页将定期与来源同步。 |
目录
Installation
The required packages are different depending on if the system is a client or a server. In this Howto, the server is the host that has the files you want to share and the client is the host that will be mounting the NFS share.
- NFSv4 client
# apt-get install nfs-common
- NFSv4 server
# apt-get install nfs-kernel-server
After you finish installing nfs-kernel-server, you might see failure to start nfs-kernel-server due to missing entries in /etc/exports. Remember to restart the service when you finish configuring.
NFSv4 without Kerberos
NFSv4 Server
NFSv4 exports exist in a single pseudo filesystem, where the
real directories are mounted with the --bind option. Here is some additional information
regarding this fact.
- Lets say we want to export our user homedirs in
/home/users. First
we create the export filesytem:
# mkdir /export # mkdir /export/users
and mount the real users directory with:
# mount --bind /home/users /export/users
To save us from retyping this after every reboot we add the following
line to /etc/fstab
/home/users /export/users none bind 0 0
- In
/etc/default/nfs-kernel-serverwe set:
NEED_SVCGSSD=no
because we do not activate NFSv4 security this time.
- In
/etc/default/nfs-commonwe set:
NEED_IDMAPD=yes NEED_GSSD=no
- To export our directories to a local network 192.198.1.0/24
we add the following two lines to /etc/exports
/export 192.168.1.0/24(ro,fsid=0,insecure,no_subtree_check,async) /export/users 192.168.1.0/24(rw,nohide,insecure,no_subtree_check,async)
- Restart the service
# /etc/init.d/nfs-kernel-server restart
NFSv4 Client
- On the client we can mount the complete export tree with one command:
# mount -t nfs4 -o proto=tcp,port=2049 nfs-server:/ /mnt
- We can also mount an exported subtree with:
# mount -t nfs4 -o proto=tcp,port=2049 nfs-server:/users /home/users
- If you experience Problems like this:
Warning: rpc.idmapd appears not to be running.
All uids will be mapped to the nobody uid.
mount: unknown filesystem type 'nfs4'
then you need to set in /etc/default/nfs-common:
NEED_IDMAPD=yes
and restart nfs-common
# /etc/init.d/nfs-common restart
The "unknown Filesystem" Error is ambiguous and will disappear as well.
NFSv4 with Kerberos
You need a working Kerberos (MIT or Heimdal) KDC (Key Distribution Center) before continuing. On the nfs-server and nfs-clients you must use MIT krb5 for now. When extracting the key to a keytab file and when configuring krb5 in /etc/krb5.conf it is neccessary to specify des-cbc-crc because only this type of encryption is supported by the kernel at the moment.
- On the nfs-server and nfs-client you need at least the krb5-user
and optinal libpam-krb5 if you wish to authenticate against krb5.
# apt-get install krb5-user # apt-get install libpam-krb5
- Specifiy des-cbc-crc in /etc/krb5.conf on nfs-servers and nfs-clients.
[libdefaults]
default_tgs_enctypes = des-cbc-crc
default_tkt_enctypes = des-cbc-crc
- You need the gss kernel modules on nfs-servers and nfs-clients.
# modprobe rpcsec_gss_krb5
Add rpcsec_gss_krb5 to /etc/modules to have it loaded automatically.
Create and distribute credentials
NFSv4 needs machine credentials for the server and every client, which wants to use the NFSv4 security features. Create the credentials for the nfs-server and all nfs-clients on the Kerberos KDC and distribute the extraced keys with scp to the destination
Heimdal
# kinit kadmin/admin # kadmin add -r nfs/nfs-server.domain # ktutil -k ~/keytab.nfs-server get -e des-cbc-crc nfs/nfs-server.domain # scp -p ~/keytab.nfs-server nfs-server:/etc/krb5.keytab # kadmin add -r nfs/nfs-client.domain # ktutil -k ~/keytab.nfs-client get -e des-cbc-crc nfs/nfs-client.domain # scp -p ~/keytab.nfs-client nfs-client:/etc/krb5.keytab # kdestroy
MIT
# kinit admin/admin # kadmin -q "addprinc -randkey nfs/nfs-server.domain" # kadmin -q "ktadd -e des-cbc-crc:normal -k ~/keytab.nfs-server nfs/nfs-server.domain" # scp -p ~/keytab.nfs-server nfs-server.domain:/etc/krb5.keytab # kadmin -q "addprinc -randkey nfs/nfs-client.domain" # kadmin -q "ktadd -e des-cbc-crc:normal -k ~/keytab.nfs-client nfs/nfs-client.domain" # scp -p ~/keytab.nfs-client nfs-client.domain:/etc/krb5.keytab # kdestroy
NFSv4 Server
- Check your machine credentials in /etc/krb5.keytab
# ktutil ktutil: rkt /etc/krb5.keytab ktutil: list slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 2 nfs/nfs-server.domain@DOMAIN
- In
/etc/default/nfs-kernel-serverwe set:
NEED_SVCGSSD=yes
- In
/etc/default/nfs-commonwe set:
NEED_IDMAPD=yes
- To export our directories from the example above to a
local network 192.198.1.0/24 and addt
we add the following two lines to /etc/exports
/export 192.168.1.0/24(ro,fsid=0,insecure, \ no_subtree_check,async,anonuid=65534,anongid=65534) /export gss/krb5(ro,fsid=0,insecure, \ no_subtree_check,async,anonuid=65534,anongid=65534) /export/users 192.168.1.0/24(rw,nohide,insecure, \ no_subtree_check,async,anonuid=65534,anongid=65534) /export/users gss/krb5(rw,nohide,insecure, \ no_subtree_check,async,anonuid=65534,anongid=65534)
Please note that you can specify allowed hosts only in the any authentication flavor. gss/krb5 flavours are accessible from anywhere, if do not use an additional firewall rules. To export only with secure authentication flavors do not include a host(...) line in /etc/exports To display your exports enter:
# exportfs -v
NFSv4 Client
- Check your machine credentials in /etc/krb5.keytab
# ktutil ktutil: rkt /etc/krb5.keytab ktutil: list slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 2 nfs/nfs-client.domain@DOMAIN
- In
/etc/default/nfs-commonwe set:
NEED_IDMAPD=yes NEED_GSSD=yes
- We can secure mount the complete export tree with:
# mount -t nfs4 -o sec=krb5,proto=tcp,port=2049 nfs-server:/ /mnt
- We can also secure mount an exported subtree with:
# mount -t nfs4 -o sec=krb5,proto=tcp,port=2049 nfs-server:/users /home/users
Troubleshooting
First, take care of proper logging - by default almost nothing is logged. e.g. to enable 3rd level verbose logging for rpc.gssd, append the following to 模板:/etc/default/nfs-common:
RPCGSSDOPTS=-vvv
After restarting nfs-common (/etc/init.d/nfs-common restart) check that the daemon has received new arguments:
ps xuwa | grep grep rpc.gssd root 9857 0.0 0.4 2496 1220 ? Ss 02:17 0:00 /usr/sbin/rpc.gssd -vvv
Then look for its log output in damon.log:
tail -f /var/log/daemon.log
For the server, you can e.g. raise rpc.svcgssd log level in /etc/default/nfs-kernel-server:
RPCSVCGSSDOPTS=-vvv
Browse the /etc/init.d/nfs-* init scripts to see other variables that you can set in /etc/defaults.
If using Kerberos, enable logging in /etc/krb5.conf:
[logging]
kdc = SYSLOG:INFO:DAEMON
admin_server = SYSLOG:INFO:DAEMON
default = SYSLOG:INFO:DAEMON
