Showing posts with label Network File System (NFS). Show all posts
Showing posts with label Network File System (NFS). Show all posts

Linux Disable / Remove All NFS Services

NFS was not designed with security in mind, and has a number of weaknesses, both in terms of the protocol itself and because any NFS installation must expose several daemons, running on both servers and clients, to network attack. I use my CentOS based server only to server web pages and nothing else. How do I disable NFS services under RHEL / CentOS / Fedora Linux?

You can easily disable NFS, which is a commonly used for sharing data and files between machines. However, its use opens many potential security holes. If NFS is not needed, improve the security by removing and disabling NFS. Open a command-line terminal (select Applications > Accessories > Terminal), and then type:
# chkconfig nfslock off
# chkconfig rpcgssd off
# chkconfig rpcidmapd off
# chkconfig portmap off
# chkconfig nfs off

Delete nfs-utils and portmap packages using the yum command:
# yum remove portmap nfs-utils

Ubuntu / Debian Linux Disable / Remove All NFS Services

NFS was not designed with security in mind, and has a number of weaknesses, both in terms of the protocol itself and because any NFS installation must expose several daemons, running on both servers and clients, to network attack. I use my Debian / Ubuntu Linux based server only to server web pages and nothing else. How do I disable NFS services under Debian or Ubuntu Linux?

Following packages are used to provide NFS client and server services under Debian / Ubuntu Linux:
  1. nfs-kernel-server - NFS server package.
  2. nfs-common - NFS support files common to client and server
  3. portmap - RPC port mapper.

Stop NFS Services

Open a command-line terminal (select Applications > Accessories > Terminal), and then type the following command top stop NFS client and server services as follows:
$ sudo service portmap stop
$ sudo service nfs-kernel-server stop
OR
$ sudo /etc/init.d/portmap stop
$ sudo /etc/init.d/nfs-kernel-server stop

Delete Services

Delete nfs-kernel-server, nfs-common, and portmap packages using the apt-get command as follows:
$ sudo apt-get --purge remove nfs-kernel-server nfs-common portmap

Setup NFS Server On CentOS, RHEL, Scientific Linux 6.5/6.4/6.3

NFS, Network File System, is a server-client protocol used for sharing files between linux/unix to unix/linux systems. NFS enables you to mount a remote share locally. You can then directly access any of the files on that remote share.
Scenario
In this how-to I use two systems running with CentOS 6.5, but it will work on all CentOS / RHEL / Scientific Linux 6.x distros.
NFS Server IP Address: 192.168.1.250/24
NFS Client IP Address: 192.168.1.251/24
1. Install NFS in Server system
# yum install nfs* -y
 2. Start NFS service
# service rpcbind start
# chkconfig rpcbind on
# service nfs start
# chkconfig nfs on
3. Install NFS in Client System
# yum install nfs* -y
4. Start NFS service
# service rpcbind start
# chkconfig rpcbind on
# service nfs start
# chkconfig nfs on
5. Create shared directories in server
Create a shared directory named ‘/var/unixmen_share’ in server and let the client users to read and write files in that directory.
# mkdir /var/unixmen_share 
# chmod 755 /var/unixmen_share/
6. Export shared directory on NFS Server
Edit file /etc/exports,
# vi /etc/exports
Add the entry as shown below.
/var/unixmen_share/     192.168.1.0/24(rw,sync,no_root_squash,no_all_squash)
 where,
/var/unixmen_share  – shared directory
192.168.1.0/24           – IP address range of clients
rw                               – Writable permission to shared folder
sync                            – Synchronize shared directory
no_root_squash          – Enable root privilege
no_all_squash             – Enable user’s authority
7. Restart the NFS service.
# service nfs restart
 8. Mount the share directory in client
Create a mount point to mount the share directory ‘var/unixmen_local’ which we created in the earlier step 5.
# mkdir /var/nfs_share
 Mount the share from server to client as shown below
# mount -t nfs 192.168.1.250:/var/unixmen_share/ /var/nfs_share/ 
mount.nfs: Connection timed out 
Probably it will show a connection timed out error which means that the firewall is blocking NFS server. To allow NFS server to access from outbound, goto NFS server system and add the as shown below in the ‘etc/sysconfig/iptables’ file.
# vi /etc/sysconfig/iptables
Append the following lines shown in red colour.
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
 -A INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT  
-A INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT 
-A INPUT -m state --state NEW -m tcp -p tcp --dport 32803 -j ACCEPT 
-A INPUT -m state --state NEW -m tcp -p tcp --dport 892 -j ACCEPT  
-A INPUT -m state --state NEW -m tcp -p tcp --dport 875 -j ACCEPT 
-A INPUT -m state --state NEW -m tcp -p tcp --dport 662 -j ACCEPT 
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
Now restart the iptables service.
# service iptables restart
Again mount the share in client system with command:
# mount -t nfs 192.168.1.250:/var/unixmen_share/ /var/nfs_share/
Now the NFS share will mount without any connection timed out error.
9. Verify NFS
Verify the share from the server is mounted or not using ‘mount’ command.
# mount
Sample output:
/dev/mapper/vg_client-lv_root on / type ext4 (rw)

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

devpts on /dev/pts type devpts (rw,gid=5,mode=620)

tmpfs on /dev/shm type tmpfs (rw,rootcontext="system_u:object_r:tmpfs_t:s0")

/dev/sda1 on /boot type ext4 (rw)

none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)

nfsd on /proc/fs/nfsd type nfsd (rw)

192.168.1.250:/var/unixmen_share/ on /var/nfs_share type nfs (rw,vers=4,addr=192.168.1.250,clientaddr=192.168.1.251) 
10.  Automount the Shares
To mount the shares automatically instead of mounting them manually at every reboot, add the following lines shown in red colour in the ‘/etc/fstab’ file of your client system.
# vi /etc/fstab
#
# /etc/fstab
# Created by anaconda on Sun Mar 3 22[root@client unixmen]:10:15 2013
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#

/dev/mapper/vg_client-lv_root / ext4 defaults 1 1
UUID=1aa7d041-056b-48f4-a773-f713759e981f /boot ext4 defaults 1 2
/dev/mapper/vg_client-lv_swap swap swap defaults 0 0
tmpfs /dev/shm tmpfs defaults 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
sysfs /sys sysfs defaults 0 0
proc /proc proc defaults 0 0
192.168.1.250:/var/unixmen_share/ /var/nfs_share/ nfs rw,sync,hard,intr 0 0
Reboot the client system and check the share whether it is automatically mounted or not.
# mount
Sample output:
/dev/mapper/vg_client-lv_root on / type ext4 (rw)

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

devpts on /dev/pts type devpts (rw,gid=5,mode=620)

tmpfs on /dev/shm type tmpfs (rw,rootcontext="system_u:object_r:tmpfs_t:s0")

/dev/sda1 on /boot type ext4 (rw)

none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)

nfsd on /proc/fs/nfsd type nfsd (rw)

192.168.1.250:/var/unixmen_share/ on /var/nfs_share type nfs (rw,vers=4,addr=192.168.1.250,clientaddr=192.168.1.251) 
Thats it. Now NFS server is ready to use.

Setting Up An NFS Server And Client On Ubuntu 10.04

This guide explains how to set up an NFS server and an NFS client on Ubuntu 10.04. NFS stands for Network File System; through NFS, a client can access (read, write) a remote share on an NFS server as if it was on the local hard disk.
I do not issue any guarantee that this will work for you!

1 Preliminary Note

I'm using two Ubuntu systems here:
  • NFS Server: server.example.com, IP address: 192.168.0.100
  • NFS Client: client.example.com, IP address: 192.168.0.101
Because we must run all the steps from this tutorial with root privileges, we can either prepend all commands in this tutorial with the string sudo, or we become root right now by typing
#sudo su

2 Installing NFS

server:
On the NFS server we run:
#aptitude install nfs-kernel-server nfs-common portmap
client:
On the client we can install NFS as follows:
#aptitude install nfs-common portmap

3 Exporting Directories On The Server

server:
I'd like to make the directories /home and /var/nfs accessible to the client; therefore we must "export" them on the server.
When a client accesses an NFS share, this normally happens as the user nobody. Usually the /home directory isn't owned by nobody (and I don't recommend to change its ownership to nobody!), and because we want to read and write on /home, we tell NFS that accesses should be made as root (if our /home share was read-only, this wouldn't be necessary). The /var/nfs directory doesn't exist, so we can create it and change its ownership to nobody and nogroup:
#mkdir /var/nfs
#chown nobody:nogroup /var/nfs
Now we must modify /etc/exports where we "export" our NFS shares. We specify /home and /var/nfs as NFS shares and tell NFS to make accesses to /home as root (to learn more about /etc/exports, its format and available options, take a look at
man 5 exports
)
#vi /etc/exports
# /etc/exports: the access control list for filesystems which may be exported
#               to NFS clients.  See exports(5).
#
# Example for NFSv2 and NFSv3:
# /srv/homes       hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
#
# Example for NFSv4:
# /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
# /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)
#
/home           192.168.0.101(rw,sync,no_root_squash,no_subtree_check)
/var/nfs        192.168.0.101(rw,sync,no_subtree_check)
(The no_root_squash option makes that /home will be accessed as root.)
Whenever we modify /etc/exports, we must run
#exportfs -a
afterwards to make the changes effective.

4 Mounting The NFS Shares On The Client

client:
First we create the directories where we want to mount the NFS shares, e.g.:
#mkdir -p /mnt/nfs/home
#mkdir -p /mnt/nfs/var/nfs
Afterwards, we can mount them as follows:
#mount 192.168.0.100:/home /mnt/nfs/home
#mount 192.168.0.100:/var/nfs /mnt/nfs/var/nfs
You should now see the two NFS shares in the outputs of
df -h
root@client:~# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/server2-root
                       29G  847M   26G   4% /
none                  243M  172K  242M   1% /dev
none                  247M     0  247M   0% /dev/shm
none                  247M   48K  247M   1% /var/run
none                  247M     0  247M   0% /var/lock
none                  247M     0  247M   0% /lib/init/rw
none                   29G  847M   26G   4% /var/lib/ureadahead/debugfs
/dev/sda1             228M   17M  199M   8% /boot
192.168.0.100:/home    18G  838M   16G   5% /mnt/nfs/home
192.168.0.100:/var/nfs
                       18G  838M   16G   5% /mnt/nfs/var/nfs
root@client:~#
and
mount
root@client:~# mount
/dev/mapper/server2-root on / type ext4 (rw,errors=remount-ro)
proc on /proc type proc (rw,noexec,nosuid,nodev)
none on /sys type sysfs (rw,noexec,nosuid,nodev)
none on /sys/fs/fuse/connections type fusectl (rw)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
none on /dev type devtmpfs (rw,mode=0755)
none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
none on /dev/shm type tmpfs (rw,nosuid,nodev)
none on /var/run type tmpfs (rw,nosuid,mode=0755)
none on /var/lock type tmpfs (rw,noexec,nosuid,nodev)
none on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
none on /var/lib/ureadahead/debugfs type debugfs (rw,relatime)
/dev/sda1 on /boot type ext2 (rw)
192.168.0.100:/home on /mnt/nfs/home type nfs (rw,addr=192.168.0.100)
192.168.0.100:/var/nfs on /mnt/nfs/var/nfs type nfs (rw,addr=192.168.0.100)
root@client:~#

5 Testing

On the client, you can now try to create test files on the NFS shares:
client:
touch /mnt/nfs/home/test.txt
touch /mnt/nfs/var/nfs/test.txt
Now go to the server and check if you can see both test files:
server:
ls -l /home/
root@server:~# ls -l /home/
total 4
drwxr-xr-x 3 administrator administrator 4096 2010-04-29 14:21 administrator
-rw-r--r-- 1 root          root             0 2010-09-14 17:11 test.txt
root@server:~#
ls -l /var/nfs
root@server:~# ls -l /var/nfs
total 0
-rw-r--r-- 1 nobody nogroup 0 2010-09-14 17:12 test.txt
root@server:~#
(Please note the different ownerships of the test files: the /home NFS share gets accessed as root, therefore /home/test.txt is owned by root; the /var/nfs share gets accessed as nobody, therefore /var/nfs/test.txt is owned by nobody.)

6 Mounting NFS Shares At Boot Time

Instead of mounting the NFS shares manually on the client, you could modify /etc/fstab so that the NFS shares get mounted automatically when the client boots.
client:
Open /etc/fstab and append the following lines:
#vi /etc/fstab
[...]
192.168.0.100:/home  /mnt/nfs/home   nfs      rw,sync,hard,intr  0     0
192.168.0.100:/var/nfs  /mnt/nfs/var/nfs   nfs      rw,sync,hard,intr  0     0
Instead of rw,sync,hard,intr you can use different mount options. To learn more about available options, take a look at
man nfs
To test if your modified /etc/fstab is working, reboot the client:
reboot
After the reboot, you should find the two NFS shares in the outputs of
df -h
root@client:~# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/server2-root
                       29G  847M   26G   4% /
none                  243M  172K  242M   1% /dev
none                  247M     0  247M   0% /dev/shm
none                  247M   48K  247M   1% /var/run
none                  247M     0  247M   0% /var/lock
none                  247M     0  247M   0% /lib/init/rw
/dev/sda1             228M   17M  199M   8% /boot
192.168.0.100:/var/nfs
                       18G  838M   16G   5% /mnt/nfs/var/nfs
192.168.0.100:/home    18G  838M   16G   5% /mnt/nfs/home
root@client:~#
and
mount
root@client:~# mount
/dev/mapper/server2-root on / type ext4 (rw,errors=remount-ro)
proc on /proc type proc (rw,noexec,nosuid,nodev)
none on /sys type sysfs (rw,noexec,nosuid,nodev)
none on /sys/fs/fuse/connections type fusectl (rw)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
none on /dev type devtmpfs (rw,mode=0755)
none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
none on /dev/shm type tmpfs (rw,nosuid,nodev)
none on /var/run type tmpfs (rw,nosuid,mode=0755)
none on /var/lock type tmpfs (rw,noexec,nosuid,nodev)
none on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
none on /var/lib/ureadahead/debugfs type debugfs (rw,relatime)
/dev/sda1 on /boot type ext2 (rw)
192.168.0.100:/var/nfs on /mnt/nfs/var/nfs type nfs (rw,sync,hard,intr,addr=192.168.0.100)
192.168.0.100:/home on /mnt/nfs/home type nfs (rw,sync,hard,intr,addr=192.168.0.100)
root@client:~#

How to Setup NFS (Network File System) on RHEL/CentOS/Fedora and Debian/Ubuntu

NFS (Network File System) is basically developed for sharing of files and folders between Linux/Unix systems by Sun Microsystems in 1980. It allows you to mount your local file systems over a network and remote hosts to interact with them as they are mounted locally on the same system. With the help of NFS, we can set up file sharing between Unix to Linux system and Linux to Unix system.

Benefits of NFS

  1. NFS allows local access to remote files.
  2. It uses standard client/server architecture for file sharing between all *nix based machines.
  3. With NFS it is not necessary that both machines run on the same OS.
  4. With the help of NFS we can configure centralized storage solutions.
  5. Users get their data irrespective of physical location.
  6. No manual refresh needed for new files.
  7. Newer version of NFS also supports acl, pseudo root mounts.
  8. Can be secured with Firewalls and Kerberos.

NFS Services

Its a System V-launched service. The NFS server package includes three facilities, included in the portmap and nfs-utils packages.
  1. portmap : It maps calls made from other machines to the correct RPC service (not required with NFSv4).
  2. nfs: It translates remote file sharing requests into requests on the local file system.
  3. rpc.mountd: This service is responsible for mounting and unmounting of file systems.

Important Files for NFS Configuration

  1. /etc/exports : Its a main configuration file of NFS, all exported files and directories are defined in this file at the NFS Server end.
  2. /etc/fstab : To mount a NFS directory on your system across the reboots, we need to make an entry in /etc/fstab.
  3. /etc/sysconfig/nfs : Configuration file of NFS to control on which port rpc and other services are listening.

Setup and Configure NFS Mounts on Linux Server

To setup NFS mounts, we’ll be needing at least two Linux/Unix machines. Here in this tutorial, I’ll be using two servers.
  1. NFS Server: nfsserver.example.com with IP-192.168.0.100
  2. NFS Client : nfsclient.example.com with IP-192.168.0.101

Installing NFS Server and NFS Client

We need to install NFS packages on our NFS Server as well as on NFS Client machine. We can install it via “yum” (Red Hat Linux) and “apt-get” (Debian and Ubuntu) package installers.
[root@nfsserver ~]# yum install nfs-utils nfs-utils-lib
[root@nfsserver ~]# yum install portmap (not required with NFSv4)
[root@nfsserver ~]# apt-get install nfs-utils nfs-utils-lib
Now start the services on both machines.
[root@nfsserver ~]# /etc/init.d/portmap start
[root@nfsserver ~]# /etc/init.d/nfs start
[root@nfsserver ~]# chkconfig --level 35 portmap on
[root@nfsserver ~]# chkconfig --level 35 nfs on
After installing packages and starting services on both the machines, we need to configure both the machines for file sharing.

Setting Up the NFS Server

First we will be configuring the NFS server.

Configure Export directory

For sharing a directory with NFS, we need to make an entry in “/etc/exports” configuration file. Here I’ll be creating a new directory named “nfsshare” in “/” partition to share with client server, you can also share an already existing directory with NFS.
[root@nfsserver ~]# mkdir /nfsshare
Now we need to make an entry in “/etc/exports” and restart the services to make our directory shareable in the network.
[root@nfsserver ~]# vi /etc/exports

/nfsshare 192.168.0.101(rw,sync,no_root_squash)
In the above example, there is a directory in / partition named “nfsshare” is being shared with client IP “192.168.0.101” with read and write (rw) privilege, you can also use hostname of the client in the place of IP in above example.

NFS Options

Some other options we can use in “/etc/exports” file for file sharing is as follows.
  1. ro: With the help of this option we can provide read only access to the shared files i.e client will only be able to read.
  2. rw: This option allows the client server to both read and write access within the shared directory.
  3. sync: Sync confirms requests to the shared directory only once the changes have been committed.
  4. no_subtree_check: This option prevents the subtree checking. When a shared directory is the subdirectory of a larger file system, nfs performs scans of every directory above it, in order to verify its permissions and details. Disabling the subtree check may increase the reliability of NFS, but reduce security.
  5. no_root_squash: This phrase allows root to connect to the designated directory.
For more options with “/etc/exports“, you are recommended to read the man pages for export.

Setting Up the NFS Client

After configuring the NFS server, we need to mount that shared directory or partition in the client server.

Mount Shared Directories on NFS Client

Now at the NFS client end, we need to mount that directory in our server to access it locally. To do so, first we need to find out that shares available on the remote server or NFS Server.
[root@nfsclient ~]# showmount -e 192.168.0.100

Export list for 192.168.0.100:
/nfsshare 192.168.0.101
Above command shows that a directory named “nfsshare” is available at “192.168.0.100” to share with your server.

Mount Shared NFS Directory

To mount that shared NFS directory we can use following mount command.
[root@nfsclient ~]# mount -t nfs 192.168.0.100:/nfsshare /mnt/nfsshare
The above command will mount that shared directory in “/mnt/nfsshare” on the client server. You can verify it following command.
[root@nfsclient ~]# mount | grep nfs

sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
nfsd on /proc/fs/nfsd type nfsd (rw)
192.168.0.100:/nfsshare on /mnt type nfs (rw,addr=192.168.0.100)
The above mount command mounted the nfs shared directory on to nfs client temporarily, to mount an NFS directory permanently on your system across the reboots, we need to make an entry in “/etc/fstab“.
[root@nfsclient ~]# vi /etc/fstab
Add the following new line as shown below.
192.168.0.100:/nfsshare /mnt  nfs defauls 0 0

Test the Working of NFS Setup

We can test our NFS server setup by creating a test file on the server end and check its availability at nfs client side or vice-versa.

At the nfsserver end

I have created a new text file named “nfstest.txt’ in that shared directory.
[root@nfsserver ~]# cat > /nfsshare/nfstest.txt

This is a test file to test the working of NFS server setup.

At the nfsclient end

Go to that shared directory in client server and you’ll find that shared file without any manual refresh or service restart.
[root@nfsclient]# ll /mnt/nfsshare
total 4
-rw-r--r-- 1 root root 61 Sep 21 21:44 nfstest.txt
root@nfsclient ~]# cat /mnt/nfsshare/nfstest.txt
This is a test file to test the working of NFS server setup.

Removing the NFS Mount

If you want to unmount that shared directory from your server after you are done with the file sharing, you can simply unmount that particular directory with “umount” command. See this example below.
root@nfsclient ~]# umount /mnt/nfsshare
You can see that the mounts were removed by then looking at the filesystem again.
[root@nfsclient ~]# df -h -F nfs
You’ll see that those shared directories are not available any more.

Important commands for NFS

Some more important commands for NFS.
  1. showmount -e : Shows the available shares on your local machine
  2. showmount -e <server-ip or hostname>: Lists the available shares at the remote server
  3. showmount -d : Lists all the sub directories
  4. exportfs -v : Displays a list of shares files and options on a server
  5. exportfs -a : Exports all shares listed in /etc/exports, or given name
  6. exportfs -u : Unexports all shares listed in /etc/exports, or given name
  7. exportfs -r : Refresh the server’s list after modifying /etc/exports
This is it with NFS mounts for now, this was just a start, I’ll come up with more option and features of NFS in our future articles. Till then, Stay connected with Tecmint.com for more exciting and interesting tutorials in future. Do leave your comments and suggestions below in the comment box.