[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Permissions on NFS mounts



On Wed, Dec 09, 2020 at 03:38:21PM -0500, Paul M Foster wrote:
I have two users on the client: paulf 1000 and nancyf 1001. On the
server, I have two users: pi 1000 and paulf 1001. I can mount the NFS
share from the server to /mnt on my client. But any files belonging to
me (user 1001 on the server) look like they belong to nancy (user 1001
on the client. More importantly, if I copy files to this share from the
client, they will look like they belong to pi (user 1000) on the server.

Is there some way in the /etc/exports file to adjust the parameters so
that files retain my ownership on the server?

Traditional NFS depends on the uid/gid matching across all the systems in a tightly controlled local network. Your solution involves changing the IDs so they match.

The newer model for NFS depends on cryptographic authentication (generally kerberos) of requests rather than assuming that everything is trusted and consistently configured. In this model you can have the uid/gid be random, but you need a kerberos server.

It is theoretically possible to do uid mapping without the authentication component, but that's all disabled by default and I'm not sure how current any of the directions or even the code is. You'd need to set up static maps in /etc/idmapd.conf and set nfs4_disable_idmapping=0 on the nfsd module. Also make sure you're using nfs4 and not nfs3. "idmapd.conf" and "nfs4_disable_idmapping" should be good google keywords to find instructions.

Depending on your use case you might also find running samba and using cifs rather than nfs works better for you. (Or not.) It has a different authentication model and interface with its own pros and cons.


Reply to: