1,381
edits
Changes
From IGEP - ISEE Wiki
→No summary
We’ll begin by installing the necessary components on each server.
'''<u>On the Host</u>'''
On the host server, we will install the nfs-kernel-server package, which will allow us to share our directories. Since this is the first operation that we're performing with apt in this session, we'll refresh our local package index before the installation:
sudo apt-get update<br>sudo apt-get install nfs-kernel-server
Once these packages are installed, switch to the client server.
'''<u>On the Client</u>'''
On the client server, we need to install a package called nfs-common, which provides NFS functionality without including unneeded server components. Again, we will refresh the local package index prior to installation to ensure that we have up-to-date information:
sudo apt-get update<br>sudo apt-get install nfs-common
Now that both servers have the necessary packages, we can start configuring them.
===Step 2 — Creating the Share Directories on the Host===
We're going to share two separate directories, with different configuration settings, in order to illustrate two key ways that NFS mounts can be configured with respect to superuser access.
Sometimes, however, there are trusted users on the client system who need to be able to do these things on the mounted file system but who have no need for superuser access on the host. The NFS server can be configured to allow this, although it introduces an element of risk, as such a user could gain root access to the entire host system.
====Example 1: Exporting a General Purpose Mount====
In the first example, we’ll create a general-purpose NFS mount that uses default NFS behavior to makes it difficult for a user with root privileges on the client machine to interact with the host using those client superuser privileges. You might use something like this to store the files uploaded using a content management system or to create space for users to easily share project files.
First, make a share directory called nfs:
sudo mkdir /var/nfs/general -p
Since we’re creating it with sudo, the directory is owned by root here on the host.
ls -la /var/nfs/general
Output
4 drwxr-xr-x 2 root root 4096 Jul 25 15:26 .NFS will translate any root operations on the client to the '''nobody:nogroup''' credentials as a security measure. Therefore, we need to change the directory ownership to match those credentials. sudo chown nobody:nogroup /var/nfs/general
This directory is now ready for export.
====Example 2: Exporting the Home Directory====
In our second example, the goal is to make user home directories stored on the host available on client servers, while allowing trusted administrators of those client servers the access they need to conveniently manage users.
