2.7. Configuring an NFSv4-only server

Procedure

1. Install the nfs-utils package:

   # dnf install nfs-utils

2. Edit the /etc/nfs.conf file, and make the following changes:

   1. Disable the vers3 parameter in the [nfsd] section to disable NFSv3:

      [nfsd]
      vers3=n

   2. Optional: If you require only specific NFSv4 minor versions, uncomment all vers4.<minor_version> parameters and set them accordingly, for example:

      [nfsd]
      vers3=n
      # vers4=y
      vers4.0=n
      vers4.1=n
      vers4.2=y

      With this configuration, the server provides only NFS version 4.2.

      重要

      If you require only a specific NFSv4 minor version, set only the parameters for the minor versions. Do not uncomment the vers4 parameter to avoid an unpredictable activation or deactivation of minor versions. By default, the vers4 parameter enables or disables all NFSv4 minor versions. However, this behavior changes if you set vers4 in conjunction with other vers parameters.

3. Disable all NFSv3-related services:

   # systemctl mask --now rpc-statd.service rpcbind.service rpcbind.socket

4. Configure the rpc.mountd daemon to not listen for NFSv3 mount requests. Create a /etc/systemd/system/nfs-mountd.service.d/v4only.conf file with the following content:

   [Service]
   ExecStart=
   ExecStart=/usr/sbin/rpc.mountd --no-tcp --no-udp

5. Reload the systemd manager configuration and restart the nfs-mountd service:

   # systemctl daemon-reload
   # systemctl restart nfs-mountd

6. Optional: Create a directory that you want to share, for example:

   # mkdir -p /nfs/projects/

   If you want to share an existing directory, skip this step.

7. Set the permissions you require on the /nfs/projects/ directory:

   # chmod 2770 /nfs/projects/
   # chgrp users /nfs/projects/

   These commands set write permissions for the users group on the /nfs/projects/ directory and ensure that the same group is automatically set on new entries created in this directory.

8. Add an export point to the /etc/exports file for each directory that you want to share:

   /nfs/projects/     192.0.2.0/24(rw) 2001:db8::/32(rw)

   This entry shares the /nfs/projects/ directory to be accessible with read and write access to clients in the 192.0.2.0/24 and 2001:db8::/32 subnets.

9. Open the relevant ports in firewalld:

   # firewall-cmd --permanent --add-service nfs
   # firewall-cmd --reload

10. Enable and start the NFS server:

    # systemctl enable --now nfs-server