From Fedora Project Wiki
(updated firewall settings to use firewall-cmd)
m (minor typo on selinux note)
 
(23 intermediate revisions by 3 users not shown)
Line 4: Line 4:
  
 
== Description ==
 
== Description ==
This HowTo explains how to set up the <code>Network File System version 4</code> on your ''LAN'' for multiple shares. It explains, also, how to mount the <code>exports</code> on your ''client''.
+
This HowTo explains how to set up the <code>Network File System version 4</code> on your ''LAN'' for multiple shares. It explains, also, how to mount the <code>exports</code> on your ''client(s)''.
  
 
== Tested in Fedora Versions ==
 
== Tested in Fedora Versions ==
Line 15: Line 15:
  
 
=== Server requirements (services) ===
 
=== Server requirements (services) ===
 +
* <code>rpcbind</code>
 +
* <code>rpcidmapd</code>
 
* <code>nfs</code>
 
* <code>nfs</code>
* <code>rpc2</code>
 
  
 
=== Client requirements ((services) ===
 
=== Client requirements ((services) ===
 +
* <code>rpcbind</code>
 +
* <code>rpcidmapd</code>
 
* <code>nfs</code>
 
* <code>nfs</code>
* <code>nfslock</code>
 
* <code>rpc2</code>
 
  
 +
== Doing the Work ==
  
== Doing the Work ==
+
{{admon/note|Doing the work as root|Yes, this is administrative work so you can just issue <code>su -</code> and avoid so many <code>su -c '...'</code>. Just remember to <code>logout</code> after you're done.}}
  
 
=== Configuring the server ===
 
=== Configuring the server ===
 +
* Change your eth1 (internal) interface to the "internal" zone
 +
<pre>
 +
su -c 'firewall-cmd --zone=internal --change-interface=eth1'
 +
</pre>
  
 
* Open up the necessary ''port'' on the ''firewall'' (<code>port: 2049 TCP</code>).
 
* Open up the necessary ''port'' on the ''firewall'' (<code>port: 2049 TCP</code>).
 
<pre>
 
<pre>
su -c "firewall-cmd --permanent --add-service=nfs"
+
su -c "firewall-cmd --permanent --zone=internal --add-service=nfs"
 +
su -c "firewall-cmd --permanent --zone=internal --add-service=rpc-bind"
 +
su -c "firewall-cmd --permanent --zone=internal --add-service=mountd"
 
su -c "firewall-cmd --reload"
 
su -c "firewall-cmd --reload"
 
</pre>
 
</pre>
 +
 +
{{admon/important|Disallow unnecessary services from the firewall| I would totally recommend removing all unnecessary services from the '''internal''' zone. For example, I do not need printers nor samba here so: <code><nowiki>su -c "for s in samba-client ipp-client; do firewall-cmd --permanent --zone=internal --remove-service=$s; done"</nowiki></code>}}
  
 
* Edit <code>/etc/idmapd.conf</code>. Enter your <code>root</code> password when prompted:
 
* Edit <code>/etc/idmapd.conf</code>. Enter your <code>root</code> password when prompted:
Line 40: Line 50:
 
<pre>
 
<pre>
 
[General]
 
[General]
Domain = example.com
+
Domain = domain.tld
  
 
[Mapping]
 
[Mapping]
Line 47: Line 57:
 
</pre>
 
</pre>
  
* Start the <code>rpcidmapd</code> and <code>nfslock</code> services, then start the <code>nfs</code> service. Alternatively, you can use ''System->Administration->Services'' GUI. Please enter the <code>root</code> password when prompted:
+
* Enable <code>rpcbind</code>, <code>rpcidmapd</code>, and <code>nfs</code> services to start at boot:
 
<pre>
 
<pre>
su -c "service rpcbind start"
+
su -c "systemctl enable rpcbind.service nfs-idmap.service nfs-server.service"
su -c "service rpcidmapd start"
 
su -c "service nfslock start"
 
su -c "service nfs start"
 
 
</pre>
 
</pre>
  
* Set <code>rpcidmapd</code>, <code>nfslock</code>, and <code>nfs</code> services to start on boot. Alternatively, you can use ''System->Administration->Services'' GUI. Please enter the <code>root</code> password when prompted:
+
* Start those services:
 
<pre>
 
<pre>
su -c "chkconfig --level 345 rpcbind on"
+
su -c "systemctl start rpcbind.service nfs-idmap.service nfs-server.service"
su -c "chkconfig --level 345 rpcidmapd on"
 
su -c "chkconfig --level 345 nfslock on"
 
su -c "chkconfig --level 345 nfs on"
 
 
</pre>
 
</pre>
 
* Create the directories of the exports inside <code>/srv/nfs</code>. Enter your <code>root</code> password when prompted:
 
<pre>su -c "mkdir -p /srv/nfs/{share1,share2,share3}"</pre>
 
 
* Edit <code>/etc/fstab</code>:
 
<pre>su -c "vim /etc/fstab"</pre>
 
 
* ''Bind'' the desired ''shares'' to the, recently created, directories; at <code>/srv/nfs</code>:
 
<pre>
 
/path/to/share1 /srv/nfs/share1 none bind 0 0
 
/path/to/share2 /srv/nfs/share2 none bind 0 0
 
/path/to/share3 /srv/nfs/share3 none bind 0 0
 
</pre>
 
 
* ''Remount'' everything. Enter your <code>root</code> password when prompted:
 
<pre>su -c "mount -a"</pre>
 
  
 
* Edit <code>/etc/exports</code>. Enter your <code>root</code> password when prompted:
 
* Edit <code>/etc/exports</code>. Enter your <code>root</code> password when prompted:
Line 84: Line 72:
 
* Add your shares here (available to your home network) If you want your shares to be ''read only'', change <code>rw</code> to <code>ro</code> from these statements:
 
* Add your shares here (available to your home network) If you want your shares to be ''read only'', change <code>rw</code> to <code>ro</code> from these statements:
 
<pre>
 
<pre>
/srv/nfs 192.168.1.0/255.255.255.0(rw,insecure,no_subtree_check,nohide,fsid=0)
+
/srv/nfs/share1     192.168.1.0/255.255.255.0(rw,sync)
/srv/nfs/share1 192.168.1.0/255.255.255.0(rw,insecure,no_subtree_check,nohide)
+
/srv/nfs/share2     192.168.1.0/255.255.255.0(ro)
/srv/nfs/share2             192.168.1.0/255.255.255.0(rw,insecure,no_subtree_check,nohide)
+
/srv/nfs/share3     192.168.1.0/255.255.255.0(rw)
/srv/nfs/share3             192.168.1.0/255.255.255.0(rw,insecure,no_subtree_check,nohide)
 
 
</pre>
 
</pre>
  
* Reload your exports. Please enter your <code>root</code> password when prompted:
+
* Reload your exports:
 
<pre>su -c "/usr/sbin/exportfs -rv"</pre>
 
<pre>su -c "/usr/sbin/exportfs -rv"</pre>
  
* Edit your <code>/etc/hosts.allow</code> file, so your clients are allowed to access your nfs. Please enter your <code>root</code> password when prompted:
+
* Edit your <code>/etc/hosts.allow</code> file, so your clients are allowed to access your shares:
 
<pre>su -c "vim /etc/hosts.allow"</pre>
 
<pre>su -c "vim /etc/hosts.allow"</pre>
  
* Allow your LAN to access your services:
+
* Allow your LAN to access your shares:
 
<pre>rpcbind: 192.168.1.0/255.255.255.0</pre>
 
<pre>rpcbind: 192.168.1.0/255.255.255.0</pre>
 
* <code>Reboot</code>:
 
<pre>su -c "/sbin/shutdown -r now"</pre>
 
  
 
=== Configuring the clients ===
 
=== Configuring the clients ===
Line 109: Line 93:
 
<pre>
 
<pre>
 
[General]
 
[General]
Domain = example.com
+
Domain = domain.tld
  
 
[Mapping]
 
[Mapping]
Line 116: Line 100:
 
</pre>
 
</pre>
  
* Edit <code>/etc/fstab</code>. Please enter your <code>root</code> password when prompted:
+
* Edit <code>/etc/fstab</code>:
 
<pre>su -c "vim /etc/fstab"</pre>
 
<pre>su -c "vim /etc/fstab"</pre>
 
* Create the mounting directories:
 
<pre>su -c "mkdir /mnt/shares /home/me/share1 /home/he/share2 /home/it/share3"</pre>
 
  
 
* Add the desired shares:
 
* Add the desired shares:
 
<pre>
 
<pre>
<ip-address-to-server>:/ /mnt/shares nfs4 rsize=8192,wsize=8192,timeo=14,soft
+
<ip-address-to-server>:/srv/nfs/share1  /mnt/share1                                        nfs4   rsize=8192,wsize=8192,timeo=14,soft     0 0
<ip-address-to-server>:/share1 /home/me/share1 nfs4 rsize=8192,wsize=8192,timeo=14,soft
+
<ip-address-to-server>:/srv/nfs/share2  /srv/www/somewebsite.tld/default/public/share2     nfs4   rsize=8192,wsize=8192,timeo=14,soft     0 0
<ip-address-to-server>:/share2 /home/he/share2 nfs4 rsize=8192,wsize=8192,timeo=14,soft
+
<ip-address-to-server>:/srv/nfs/share3 /home/user/share3                                   nfs4   rsize=8192,wsize=8192,timeo=14,soft     0 0
<ip-address-to-server>:/share3 /home/it/share3 nfs4 rsize=8192,wsize=8192,timeo=14,soft
 
 
</pre>
 
</pre>
 +
 +
{{admon/note|SELinux Booleans|You need to remember to activate a relevant boolean. There a few '''SELinux''' booleans for '''nfs''' in general. Make sure to check them out by using <code><nowiki>getsebool -a | grep -i nfs</nowiki></code> and enable them permanently with <code><nowiki>setsebool -P <someboolean>=1 <someotherbool>=1 ...</nowiki></code>}}
  
 
* Remount everything:
 
* Remount everything:
Line 134: Line 116:
  
 
== Common problems and fixes ==
 
== Common problems and fixes ==
=== Exported subdirectory appears empty ===
+
=== Can't write to a rw share ===
 +
Nope, it's just that you're using <code>root</code> to try and write while not adding no_root_squash to your exports. This will map root to <code>nfsnobody</code> you  on the other server so if <code>nfsnobody</code> doesn't have write permissions at your server, you're screwed.
 +
 
 +
You should read <code>man exports</code> to get more info on this.
  
If <code>/srv/nfs/share1</code> appears empty on the client make sure it's exported with the <code>nohide</code> parameter. Because <code>/srv/nfs/share1</code> was mounted under <code>/srv/nfs</code>, the client can't see it unless the <code>nohide</code> parameter is used.
+
=== Apache can't use the share ===
 +
So, yeah; '''SELinux''' is preventing you from using the share. Just read the note about '''SELinux''' booleans... you might've missed it; it's up there. ;=)
  
 
== More Information ==
 
== More Information ==
RedHat recommends, on RHEL5 Docs, that one should use automount instead of /etc/fstab; which saves resources when sharing to multiple workstations. I haven't had the time to try this configuration. This document will be modified/augmented once I've got the hang of it.
+
It is hard to find since, it seems, '''NFSv4''' disapeard from updated docs.  
  
== Disclaimer ==
+
RedHat recommends, on RHEL5 Docs, that one should use automount instead of /etc/fstab; which saves resources when sharing to multiple workstations. Feel free to extend it if you know how ;=)
I haven't had the opportunity to test this HowTo since I lack of a networked PC to do it, so you may run into problems, if you do, come to [irc://irc.freenode.net/fedora #fedora on irc.freenode.net] or leave me messages so I know what's up. Feel free to propose changes and stuff.
 
  
 
== Added Reading ==
 
== Added Reading ==
* http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.4/html/Deployment_Guide/ch-nfs.html
+
* https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/5/html/Deployment_Guide/ch-nfs.html
 
* http://www.brennan.id.au/19-Network_File_System.html
 
* http://www.brennan.id.au/19-Network_File_System.html
 +
* http://www.linux-nfs.org/wiki/index.php/NFS_and_FreeIPA
 +
* http://doc.opensuse.org/documentation/html/openSUSE/opensuse-reference/cha.nfs.html
  
 
[[Category: How_to]]
 
[[Category: How_to]]

Latest revision as of 18:06, 11 June 2014

Sharing files with NFSv4 on Fedora (Server & Client configuration)

Description

This HowTo explains how to set up the Network File System version 4 on your LAN for multiple shares. It explains, also, how to mount the exports on your client(s).

Tested in Fedora Versions

  • Fedora 19

Requirements

The nfs-utils package provides what's need for both then client and the server. However, to make sure it's installed, run the following command. Enter your root password when prompted:

su -c "yum install nfs-utils"

Server requirements (services)

  • rpcbind
  • rpcidmapd
  • nfs

Client requirements ((services)

  • rpcbind
  • rpcidmapd
  • nfs

Doing the Work

Note.png
Doing the work as root
Yes, this is administrative work so you can just issue su - and avoid so many su -c '...'. Just remember to logout after you're done.

Configuring the server

  • Change your eth1 (internal) interface to the "internal" zone
su -c 'firewall-cmd --zone=internal --change-interface=eth1'
  • Open up the necessary port on the firewall (port: 2049 TCP).
su -c "firewall-cmd --permanent --zone=internal --add-service=nfs"
su -c "firewall-cmd --permanent --zone=internal --add-service=rpc-bind"
su -c "firewall-cmd --permanent --zone=internal --add-service=mountd"
su -c "firewall-cmd --reload"
Important.png
Disallow unnecessary services from the firewall
I would totally recommend removing all unnecessary services from the internal zone. For example, I do not need printers nor samba here so: su -c "for s in samba-client ipp-client; do firewall-cmd --permanent --zone=internal --remove-service=$s; done"
  • Edit /etc/idmapd.conf. Enter your root password when prompted:
su -c "vim /etc/idmapd.conf"
  • Configure your domain name and change the users to nfsnobody:
[General]
Domain = domain.tld

[Mapping]
Nobody-User = nfsnobody
Nobody-Group = nfsnobody
  • Enable rpcbind, rpcidmapd, and nfs services to start at boot:
su -c "systemctl enable rpcbind.service nfs-idmap.service nfs-server.service"
  • Start those services:
su -c "systemctl start rpcbind.service nfs-idmap.service nfs-server.service"
  • Edit /etc/exports. Enter your root password when prompted:
su -c "vim /etc/exports"
  • Add your shares here (available to your home network) If you want your shares to be read only, change rw to ro from these statements:
/srv/nfs/share1     192.168.1.0/255.255.255.0(rw,sync)
/srv/nfs/share2     192.168.1.0/255.255.255.0(ro)
/srv/nfs/share3     192.168.1.0/255.255.255.0(rw)
  • Reload your exports:
su -c "/usr/sbin/exportfs -rv"
  • Edit your /etc/hosts.allow file, so your clients are allowed to access your shares:
su -c "vim /etc/hosts.allow"
  • Allow your LAN to access your shares:
rpcbind: 192.168.1.0/255.255.255.0

Configuring the clients

  • Edit /etc/idmapd.conf. Enter your root password when prompted:
su -c "vim /etc/idmapd.conf"
  • Configure your domain name and change the users to nfsnobody:
[General]
Domain = domain.tld

[Mapping]
Nobody-User = nfsnobody
Nobody-Group = nfsnobody
  • Edit /etc/fstab:
su -c "vim /etc/fstab"
  • Add the desired shares:
<ip-address-to-server>:/srv/nfs/share1  /mnt/share1                                         nfs4    rsize=8192,wsize=8192,timeo=14,soft     0 0
<ip-address-to-server>:/srv/nfs/share2  /srv/www/somewebsite.tld/default/public/share2      nfs4    rsize=8192,wsize=8192,timeo=14,soft     0 0
<ip-address-to-server>:/srv/nfs/share3  /home/user/share3                                   nfs4    rsize=8192,wsize=8192,timeo=14,soft     0 0
Note.png
SELinux Booleans
You need to remember to activate a relevant boolean. There a few SELinux booleans for nfs in general. Make sure to check them out by using getsebool -a | grep -i nfs and enable them permanently with setsebool -P <someboolean>=1 <someotherbool>=1 ...
  • Remount everything:
su -c "mount -a"

Common problems and fixes

Can't write to a rw share

Nope, it's just that you're using root to try and write while not adding no_root_squash to your exports. This will map root to nfsnobody you on the other server so if nfsnobody doesn't have write permissions at your server, you're screwed.

You should read man exports to get more info on this.

Apache can't use the share

So, yeah; SELinux is preventing you from using the share. Just read the note about SELinux booleans... you might've missed it; it's up there. ;=)

More Information

It is hard to find since, it seems, NFSv4 disapeard from updated docs.

RedHat recommends, on RHEL5 Docs, that one should use automount instead of /etc/fstab; which saves resources when sharing to multiple workstations. Feel free to extend it if you know how ;=)

Added Reading