209.2 NFS Server Configuration

Introduction

NFS exposes Unix filesystems over a network. Security depends on network policy, export options, identity consistency, filesystem permissions, and the selected NFS version.

What you should be able to do after this lesson:

• Write and reload /etc/exports entries.
• Mount NFS exports manually and through /etc/fstab.
• Interpret root_squash, sync behavior, and client restrictions.
• Inspect RPC and NFS activity.
• Explain key differences between NFSv3 and NFSv4.

Big Idea: NFS Authorizes Hosts but Filesystems Authorize Identities

An export rule decides which clients may reach a shared tree and with which broad options. The files inside still use Unix ownership, mode bits, ACLs, and possibly Kerberos identities. Treat export authorization and file authorization as separate checks.

Configure Exports

/srv/projects 192.0.2.0/24(rw,sync,root_squash)
/srv/archive  192.0.2.20(ro,sync)

Client specification and option parentheses must not be separated by an unintended space. A space changes parsing and can broaden access.

Important options:

• ro or rw
• sync to acknowledge writes after stable storage handling
• root_squash to map remote root to an unprivileged identity
• no_root_squash, which is high risk and rarely appropriate
• subtree_check or no_subtree_check

Apply and inspect:

exportfs -rav
exportfs -v

Client Mounts

showmount -e server.example
mount -t nfs -o vers=4 server.example:/projects /mnt/projects

Persistent example:

server.example:/projects /mnt/projects nfs4 rw,_netdev 0 0

Use automounting when a temporarily unavailable server should not block client boot.

Identity and Permissions

Traditional NFS commonly trusts numeric UID and GID values. Matching user names with different IDs can produce unexpected ownership. NFSv4 can integrate stronger authentication, including Kerberos, but it still needs deliberate identity configuration.

Server export policy does not replace Unix permissions or ACLs on exported files.

NFSv3 and NFSv4

NFSv3 uses additional RPC services such as mountd and rpcbind/portmapper. NFSv4 consolidates more operation through TCP port 2049, provides a pseudo-filesystem namespace, and supports stronger security models.

Inspect services and statistics:

rpcinfo -p server.example
nfsstat -s
nfsstat -c
cat /proc/mounts

NFSv4 security flavors can include Kerberos-backed sec=krb5, integrity-protected sec=krb5i, and privacy-protected sec=krb5p. Their use requires functioning Kerberos and identity infrastructure; selecting the option alone does not create that trust.

Troubleshooting

1. Confirm the server exported the expected path.
2. Verify name resolution and network ports.
3. Confirm the requested NFS version.
4. Compare numeric identities.
5. Check export options and local filesystem permissions.
6. Review server and client logs.

TCP Wrappers files may appear in older NFS documentation, but they affect only supported daemons and do not replace a firewall.

Guided Practice: Export, Mount, and Verify Identity

On an isolated pair of lab systems, export a dedicated test directory to only the client address. Apply configuration and inspect it:

sudo exportfs -rav
sudo exportfs -v
rpcinfo -p
nfsstat -s

From the client, compare discovery and mounting:

showmount -e <server>
sudo mount -t nfs -o vers=3 <server>:/srv/nfs/lab /mnt/nfs-lab
nfsstat -m

Repeat with NFSv4 using the correct exported namespace. Create a file as a normal user and compare numeric UID/GID on both systems. Test how remote root is represented with root_squash; do not enable no_root_squash merely to make a permission error disappear.

Troubleshooting Scenario

The client mounts an export but every file appears owned by an unexpected numeric ID. User names match, but UID values differ between client and server.

Align identity sources or configure the intended NFSv4 identity mechanism. Changing export rw options cannot translate inconsistent identities and may broaden access without fixing ownership.

Exam Focus

• Know /etc/exports, exportfs, showmount, nfsstat, rpcinfo, mountd, and portmapper/rpcbind roles.
• Understand server and client mount options, including root_squash.
• Compare NFSv3's auxiliary RPC services with NFSv4's integrated namespace and security.
• Recognize TCP Wrappers as historical, service-dependent access control.

Recap

• /etc/exports syntax and whitespace matter.
• root_squash limits remote root privileges.
• NFS access combines exports, network controls, IDs, and filesystem permissions.
• NFSv4 differs operationally from NFSv3 and usually simplifies firewalling.