9.3. NFS Server Configuration
There are three ways to configure an NFS server under Red Hat Enterprise Linux: using the NFS Server Configuration Tool (
system-config-nfs), manually editing its configuration file (/etc/exports), or using the /usr/sbin/exportfs command.
For instructions on using NFS Server Configuration Tool, refer to the chapter titled Network File System (NFS) in the System Administrators Guide. The remainder of this section discusses manually editing
/etc/exports and using the /usr/sbin/exportfs command to export NFS file systems.
9.3.1. The /etc/exports Configuration File
The
/etc/exports file controls which file systems are exported to remote hosts and specifies options. Blank lines are ignored, comments can be made by starting a line with the hash mark (#), and long lines can be wrapped with a backslash (\). Each exported file system should be on its own individual line, and any lists of authorized hosts placed after an exported file system must be separated by space characters. Options for each of the hosts must be placed in parentheses directly after the host identifier, without any spaces separating the host and the first parenthesis.
A line for an exported file system has the following structure:
<export> <host1>(<options>) <hostN>(<options>)...
In this structure, replace <export> with the directory being exported, replace <host1> with the host or network to which the export is being shared, and replace <options> with the options for that host or network. Additional hosts can be specified in a space separated list.
The following methods can be used to specify host names:
- single host — Where one particular host is specified with a fully qualified domain name, hostname, or IP address.
- wildcards — Where a
*or?character is used to take into account a grouping of fully qualified domain names that match a particular string of letters. Wildcards should not be used with IP addresses; however, it is possible for them to work accidentally if reverse DNS lookups fail.Be careful when using wildcards with fully qualified domain names, as they tend to be more exact than expected. For example, the use of*.example.comas a wildcard allows sales.example.com to access an exported file system, but not bob.sales.example.com. To match both possibilities both*.example.comand*.*.example.commust be specified. - IP networks — Allows the matching of hosts based on their IP addresses within a larger network. For example,
192.168.0.0/28allows the first 16 IP addresses, from 192.168.0.0 to 192.168.0.15, to access the exported file system, but not 192.168.0.16 and higher. - netgroups — Permits an NIS netgroup name, written as
@<group-name>, to be used. This effectively puts the NIS server in charge of access control for this exported file system, where users can be added and removed from an NIS group without affecting/etc/exports.
In its simplest form, the
/etc/exports file only specifies the exported directory and the hosts permitted to access it, as in the following example:
/exported/directory bob.example.com
In the example,
bob.example.com can mount /exported/directory/. Because no options are specified in this example, the following default NFS options take effect:
ro— Mounts of the exported file system are read-only. Remote hosts are not able to make changes to the data shared on the file system. To allow hosts to make changes to the file system, the read/write (rw) option must be specified.wdelay— Causes the NFS server to delay writing to the disk if it suspects another write request is imminent. This can improve performance by reducing the number of times the disk must be accessed by separate write commands, reducing write overhead. Theno_wdelayoption turns off this feature, but is only available when using thesyncoption.root_squash— Prevents root users connected remotely from having root privileges and assigns them the user ID for the usernfsnobody. This effectively "squashes" the power of the remote root user to the lowest local user, preventing unauthorized alteration of files on the remote server. Alternatively, theno_root_squashoption turns off root squashing. To squash every remote user, including root, use theall_squashoption. To specify the user and group IDs to use with remote users from a particular host, use theanonuidandanongidoptions, respectively. In this case, a special user account can be created for remote NFS users to share and specify(anonuid=<uid-value>,anongid=<gid-value>), where<uid-value>is the user ID number and<gid-value>is the group ID number.
Important
By default, access control lists (ACLs) are supported by NFS under Red Hat Enterprise Linux. To disable this feature, specify the
no_acl option when exporting the file system. For more about this feature, refer to the chapter titled Network File System (NFS) in the System Administrators Guide.
Each default for every exported file system must be explicitly overridden. For example, if the
rw option is not specified, then the exported file system is shared as read-only. The following is a sample line from /etc/exports which overrides two default options:
/another/exported/directory 192.168.0.3(rw,sync)
In this example
192.168.0.3 can mount /another/exported/directory/ read/write and all transfers to disk are committed to the disk before the write request by the client is completed.
Additionally, other options are available where no default value is specified. These include the ability to disable sub-tree checking, allow access from insecure ports, and allow insecure file locks (necessary for certain early NFS client implementations). Refer to the
exports man page for details on these lesser used options.
Warning
The format of the
/etc/exports file is very precise, particularly in regards to use of the space character. Remember to always separate exported file systems from hosts and hosts from one another with a space character. However, there should be no other space characters in the file except on comment lines.
For example, the following two lines do not mean the same thing:
/home bob.example.com(rw) /home bob.example.com (rw)
The first line allows only users from
bob.example.com read/write access to the /home directory. The second line allows users from bob.example.com to mount the directory as read-only (the default), while the rest of the world can mount it read/write.
For detailed instructions on configuring an NFS server by editing
/etc/exports, refer to the chapter titled Network File System (NFS) in the System Administrators Guide.
