NFS Utilities - Revision history

DX-MON: /* Server Configuration */ Angle brackets in the exports configuration line cause syntax errors.

2013-07-09T22:45:56Z

Server Configuration: Angle brackets in the exports configuration line cause syntax errors.

← Older revision		Revision as of 15:45, 9 July 2013
Line 170:		Line 170:
	'''/etc/exports''' contains the exported directories on NFS servers. The "NFS HowTo", http://nfs.sourceforge.net/nfs-howto/. contains information on how to configure the servers and clients. For example, for sharing the '''/home''' directory over the local network, the following line may be added:		'''/etc/exports''' contains the exported directories on NFS servers. The "NFS HowTo", http://nfs.sourceforge.net/nfs-howto/. contains information on how to configure the servers and clients. For example, for sharing the '''/home''' directory over the local network, the following line may be added:

	/home <192.168.0.0/255.255.255.0>(rw,subtree_check,anonuid=99,anongid=99)		/home 192.168.0.0/255.255.255.0(rw,subtree_check,anonuid=99,anongid=99)

	[[Category:Servers]]		[[Category:Servers]]

2013-07-09T22:05:27Z

/etc/fstab: Added examples for NFSv4 fstab entries

← Older revision		Revision as of 15:05, 9 July 2013
Line 123:		Line 123:

	'''<server-name>''' in the above example is an ip address or a hostname.		'''<server-name>''' in the above example is an ip address or a hostname.

			Example equivilent NFSv4 entries with the '''/home''' mount using Krb5 for security:

			<server-name>:/home /home nfs4 rw,_netdev,sec=krb5,hard,intr 0 0
			<server-name>:/usr /usr nfs4 ro,_netdev,sec=sys,hard,intr 0 0

	== Server ==		== Server ==

2013-07-09T22:01:05Z

NFSv4: Upgraded the key security used in the Kerberos KDC server setup

← Older revision		Revision as of 15:01, 9 July 2013
Line 131:		Line 131:

	kadmin.local -q "addprinc -randkey ''<fqdn of client>''@''<REALMNAME.COM>''"		kadmin.local -q "addprinc -randkey ''<fqdn of client>''@''<REALMNAME.COM>''"
	kadmin.local -q "ktadd -e ~~des~~-~~cbc~~-~~crc~~:normal -k temp.keytab nfs/''<fqdn of client>''@''<REALMNAME.COM>''"		kadmin.local -q "ktadd -e aes256-cts-hmac-sha1-96:normal -k temp.keytab nfs/''<fqdn of client>''@''<REALMNAME.COM>''"

	Now securely move '''''temp.keytab''''' to '''''/etc/krb5.keytab''''' on the client. Then make sure you change the permissions on the file on the target computer:		Now securely move '''''temp.keytab''''' to '''''/etc/krb5.keytab''''' on the client. Then make sure you change the permissions on the file on the target computer:

2013-07-09T22:00:06Z

Keyutils for NFSv4

← Older revision		Revision as of 15:00, 9 July 2013
Line 92:		Line 92:
	Configure /etc/request-key.conf using:		Configure /etc/request-key.conf using:

	cat >> /etc/request-key.conf <<<EOF		cat >> /etc/request-key.conf << "EOF"
	create id_resolver * * /usr/sbin/nfsidmap -t 600 %k %d		create id_resolver * * /usr/sbin/nfsidmap -t 600 %k %d
	EOF		EOF

2013-07-09T21:59:00Z

Keyutils for NFSv4: Corrected the entry due to forgetting some important stuff

← Older revision		Revision as of 14:59, 9 July 2013
Line 90:		Line 90:
	=== Keyutils for NFSv4 ===		=== Keyutils for NFSv4 ===

	~~Append a line to~~ /etc/request-key.conf ~~reading~~:		Configure /etc/request-key.conf using:

	create id_resolver * * /usr/sbin/nfsidmap -t 600 %k %d		cat >> /etc/request-key.conf <<<EOF
			create id_resolver * * /usr/sbin/nfsidmap -t 600 %k %d
			EOF

	This will allow NFSv4's ID Mapping service to run.		This will allow NFSv4's ID Mapping service to run.

2013-07-09T21:57:17Z

Client: Added NFSv4 request-key configuration

← Older revision		Revision as of 14:57, 9 July 2013
Line 87:		Line 87:

	If you already have a krb5.keytab on the target computer you can merge the two together with the '''''ktutil''''' command.		If you already have a krb5.keytab on the target computer you can merge the two together with the '''''ktutil''''' command.

			=== Keyutils for NFSv4 ===

			Append a line to /etc/request-key.conf reading:

			create id_resolver * * /usr/sbin/nfsidmap -t 600 %k %d

			This will allow NFSv4's ID Mapping service to run.

	=== Bootscript ===		=== Bootscript ===

2013-07-09T21:51:47Z

NFSv4: Increased the default security level of the Kerberos configuratio

← Older revision		Revision as of 14:51, 9 July 2013
Line 80:		Line 80:

	kadmin.local -q "addprinc -randkey ''<fqdn of client>''@''<REALMNAME.COM>''"		kadmin.local -q "addprinc -randkey ''<fqdn of client>''@''<REALMNAME.COM>''"
	kadmin.local -q "ktadd -e ~~des~~-~~cbc~~-~~crc~~:normal -k temp.keytab nfs/''<fqdn of client>''@''<REALMNAME.COM>''"		kadmin.local -q "ktadd -e aes256-cts-hmac-sha1-96:normal -k temp.keytab nfs/''<fqdn of client>''@''<REALMNAME.COM>''"

	Now securely move '''''temp.keytab''''' to '''''/etc/krb5.keytab''''' on the client. Then make sure you change the permissions on the file on the target computer:		Now securely move '''''temp.keytab''''' to '''''/etc/krb5.keytab''''' on the client. Then make sure you change the permissions on the file on the target computer:

2013-07-09T21:10:10Z

← Older revision		Revision as of 14:10, 9 July 2013
Line 54:		Line 54:

	{{note\|If you choose to enable NFSv4, drop both --disable flags, and append --with-gssglue.		{{note\|If you choose to enable NFSv4, drop both --disable flags, and append --with-gssglue.
	To work around some documented behaviour in libtool that will cause your build to subtly fail,		To work around some documented behaviour in libtool that will cause your build to subtly fail, prepend GSSGLUE_CFLAGS="-Wl,-lgssglue" to the start of your configure line.}}
	prepend GSSGLUE_CFLAGS="-Wl,-lgssglue" to the start of your configure line.}}

	Install the package		Install the package

2013-07-09T21:09:25Z

← Older revision		Revision as of 14:09, 9 July 2013
Line 55:		Line 55:
	{{note\|If you choose to enable NFSv4, drop both --disable flags, and append --with-gssglue.		{{note\|If you choose to enable NFSv4, drop both --disable flags, and append --with-gssglue.
	To work around some documented behaviour in libtool that will cause your build to subtly fail,		To work around some documented behaviour in libtool that will cause your build to subtly fail,
	prepend GSSGLUE_CFLAGS="-Wl,-lgssglue" to the start of your configure line.}}		prepend GSSGLUE_CFLAGS="-Wl,-lgssglue" to the start of your configure line.}}

	Install the package		Install the package

2013-07-09T21:01:38Z

Optional for NFSv4 Support: Added keyutils to the list of NFSv4 requirements

← Older revision		Revision as of 14:01, 9 July 2013
Line 17:		Line 17:
	* [[libevent]]		* [[libevent]]
	* [[libnfsidmap]]		* [[libnfsidmap]]
			* [[keyutils]]

	=== Optional for GSS (RPC Security) Support ===		=== Optional for GSS (RPC Security) Support ===