Chapter 4. Mounting NFS shares

Procedure

1. By default, NFSv3 RPC services use random ports. To enable a firewall configuration, configure fixed port numbers in the /etc/nfs.conf file:

   1. In the [lockd] section, set a fixed port number for the nlockmgr RPC service, for example:

      port=5555

      With this setting, the service automatically uses this port number for both the UDP and TCP protocol.

   2. In the [statd] section, set a fixed port number for the rpc.statd service, for example:

      port=6666

      With this setting, the service automatically uses this port number for both the UDP and TCP protocol.

2. Open the relevant ports in firewalld:

   # firewall-cmd --permanent --add-service=rpc-bind
   # firewall-cmd --permanent --add-port={5555/tcp,5555/udp,6666/tcp,6666/udp}
   # firewall-cmd --reload

3. Restart the rpc-statd service:

   # systemctl restart rpc-statd nfs-server

Procedure

1. Edit the /etc/fstab file and add a line for the share that you want to mount:

   <nfs_server_ip_or_hostname>:/<exported_share> <mount point> nfs default 0 0

   For example, to mount the /nfs/home share from the server.example.com NFS server to /home, enter:

   server.example.com:/nfs/projects    	/home        nfs 	defaults    	0 0

2. Mount the share:

   # mount /home

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. In the Storage table, click the menu button.

4. From the drop-down menu, select New NFS mount.

   

5. In the New NFS Mount dialog box, enter the server or IP address of the remote server.
6. In the Path on Server field, enter the path to the directory that you want to mount.
7. In the Local Mount Point field, enter the path to the directory on your local system where you want to mount the NFS.

8. In the Mount options check box list, select how you want to mount the NFS. You can select multiple options depending on your requirements.

   • Check the Mount at boot box if you want the directory to be reachable even after you restart the local system.
   • Check the Mount read only box if you do not want to change the content of the NFS.

   • Check the Custom mount options box and add the mount options if you want to change the default mount option.

     

9. Click Add.

Procedure

1. Log in to the RHEL 8 web console. For details, see Logging in to the web console.
2. Click Storage.
3. In the Storage table, click the NFS mount you want to adjust.

4. If the remote directory is mounted, click Unmount.

   You must unmount the directory during the custom mount options configuration. Otherwise, the web console does not save the configuration and this causes an error.

5. Click Edit.
6. In the NFS Mount dialog box, select Custom mount option.

7. Enter mount options separated by a comma. For example:

   • nfsvers=4: The NFS protocol version number
   • soft: The type of recovery after an NFS request times out
   • sec=krb5: The files on the NFS server can be secured by Kerberos authentication. Both the NFS client and server have to support Kerberos authentication.

   For a complete list of the NFS mount options, enter man nfs in the command line.

8. Click Apply.
9. Click Mount.

Procedure

1. Obtain a kerberos ticket as an IdM administrator:

   # kinit admin

2. Retrieve the host principal, and store it in the /etc/krb5.keytab file:

   # ipa-getkeytab -s idm_server.idm.example.com -p host/nfs_client.idm.example.com -k /etc/krb5.keytab

   IdM automatically created the host principal when you joined the host to the IdM domain.

3. Optional: Display the principals in the /etc/krb5.keytab file:

   # klist -k /etc/krb5.keytab
   Keytab name: FILE:/etc/krb5.keytab
   KVNO Principal
   ---- --------------------------------------------------------------------------
      6 host/nfs_client.idm.example.com@IDM.EXAMPLE.COM
      6 host/nfs_client.idm.example.com@IDM.EXAMPLE.COM
      6 host/nfs_client.idm.example.com@IDM.EXAMPLE.COM
      6 host/nfs_client.idm.example.com@IDM.EXAMPLE.COM

4. Use the ipa-client-automount utility to configure mapping of IdM IDs:

   # ipa-client-automount
   Searching for IPA server...
   IPA server: DNS discovery
   Location: default
   Continue to configure the system with these values? [no]: yes
   Configured /etc/idmapd.conf
   Restarting sssd, waiting for it to become available.
   Started autofs

5. Mount an exported NFS share, for example:

   # mount -o sec=krb5i server.idm.example.com:/nfs/projects/ /mnt/

   The -o sec option specifies the Kerberos security method.

Verification

1. Log in as an IdM user who has permissions to write on the mounted share.

2. Obtain a Kerberos ticket:

   $ kinit

3. Create a file on the share, for example:

   $ touch /mnt/test.txt

4. List the directory to verify that the file was created:

   $ ls -l /mnt/test.txt
   -rw-r--r--. 1 admin users 0 Feb 15 11:54 /mnt/test.txt

Procedure

1. Create the /etc/dconf/profile/user file and add the following to it:

   service-db:keyfile/user

   With this setting, dconf polls the keyfile back end to determine whether updates have been made, so settings might not be updated immediately.

2. The changes take effect when the users logs out and in.