(this answer is tested and verified in real life)
Access NFS share with several different users / NFS mount ownership problems / NFS mount share files / NFS mount access rights problems
Assume there is a file serving directory with data files on a machine somewhere in the network.
With NFS
it is difficult to grant access to several different users.
I found a way:
Unify and use the group access the good old Unix way.
Solution
a) I create a default owner for the to-be-shared-files on the host / server machine.
Example:
user доступ uid = 1002, group доступ gid 1003.
b) We assume the NFS is working fine for every one.
Access r+w is granted to any user.
Issue:
Unfortunately one user can not edit (=overwrite) the file of other users.
Idea:
One common group is created.
It will become default group for all files created by any user
(Example: доступ, gid 1003).
This is based on the Unix idea of access rights by gid and uid.
c) Change ALL user machines UMASK from 022 to 002
in /etc/login.defs:
UMASK 002
Make sure, ALL existing to-be-shared-files belong to group доступ
(tipp: for existing files & directories use "find" command with option "exec" chgrp as sudo to adapt them all).
d)
Change ALL users default group membership.
Set default membership to доступ gid 1003.
Slightly anonymized examples
Example for the hosts /etc/exports file:
/srv/alle-daten 192.168.075.0/255.255.255.0(rw,no_root_squash,nohide,no_subtree_check,all_squash,anonuid=1002,anongid=1003)
(the example ids are related to the example default user and need to match! Be careful with whitespace even if it looks strange - not allowed here)
Example for client mount in /etc/fstab :
192.168.075.111:/srv/alle-daten/ /mnt/network-alle-data-nfs nfs nofail,timeo=600,_netdev,users,rw 0 0
It took me years to find this solution. It is compatible to having an SMB mount in parallell for the same users and same files.
It works for me in real life.
If i missed to mention important config details just let me know.
Discussion
The solution is probably overdefined. Please note the man page for exports (man exports) explaines the proper mapping of any user to one common uid/gid:
By default, exportfs chooses a uid and gid of 65534 for squashed
access. These values can also be overridden by the anonuid and anongid
options. Finally, you can map all user requests to the anonymous uid
by specifying the all_squash option.
and further
all_squash: Map all uids and gids to the anonymous user.
Actually we do map them: To our default user доступ having uid = 1002, group доступ gid 1003 !
So there probably is a more simple solution possible.
There is always room for improvement.
constructive comments welcome.