3

I have a server (Ubuntu 20.04) with NFS server. I want to share the /home/user for each user. However, on the client (Ubuntu 18.04), ids are usually different from the one on the server leading to ownership issues.

The /etc/exports looks like

/home/user2 10.4.200.2(rw,sync,all_squash,anonuid=1002,anongid=1002)
/home/user3 10.4.200.3(rw,sync,all_squash,anonuid=1003,anongid=1003)
...

with

$ id user2
uid=1002(user2) gid=1002(user2) groups=1002(user2)
$ id user3
uid=1003(user3) gid=1003(user3) groups=1003(user3)

On the clients, id will be for example

$ id user2
uid=1001(user2) gid=1001(user2) groups=1001(user2)

In the fstab, I added the following line

10.4.200.2:/home/user2 /home/user2/server nfs rw 0 0

After mount the folder (mount -a), the ownership does not match

$ ls -l | grep server
drwxr-xr-x 32    1002    1002    4096 sept.  3 11:32 server
$ cd server/
$ touch foo
touch: cannot touch 'foo': Permission denied

1 Answer 1

2

(this answer is tested and verified in real life)

Access NFS share with several different users / NFS mount ownership problems / NFS mount share files / NFS mount access rights problems

Assume there is a file serving directory with data files on a machine somewhere in the network.
With NFS
it is difficult to grant access to several different users.
I found a way:
Unify and use the group access the good old Unix way.

Solution

a) I create a default owner for the to-be-shared-files on the host / server machine.
Example:
user доступ uid = 1002, group доступ gid 1003.

b) We assume the NFS is working fine for every one.
Access r+w is granted to any user.
Issue:

Unfortunately one user can not edit (=overwrite) the file of other users.

Idea:

One common group is created.
It will become default group for all files created by any user
(Example: доступ, gid 1003).
This is based on the Unix idea of access rights by gid and uid.

c) Change ALL user machines UMASK from 022 to 002
in /etc/login.defs:
UMASK 002

Make sure, ALL existing to-be-shared-files belong to group доступ
(tipp: for existing files & directories use "find" command with option "exec" chgrp as sudo to adapt them all).

d) Change ALL users default group membership.
Set default membership to доступ gid 1003.

Slightly anonymized examples

Example for the hosts /etc/exports file:

/srv/alle-daten 192.168.075.0/255.255.255.0(rw,no_root_squash,nohide,no_subtree_check,all_squash,anonuid=1002,anongid=1003)

(the example ids are related to the example default user and need to match! Be careful with whitespace even if it looks strange - not allowed here)

Example for client mount in /etc/fstab :

192.168.075.111:/srv/alle-daten/ /mnt/network-alle-data-nfs nfs nofail,timeo=600,_netdev,users,rw 0 0

It took me years to find this solution. It is compatible to having an SMB mount in parallell for the same users and same files.

It works for me in real life.
If i missed to mention important config details just let me know.

Discussion

The solution is probably overdefined. Please note the man page for exports (man exports) explaines the proper mapping of any user to one common uid/gid:

By default, exportfs chooses a uid and gid of 65534 for squashed access. These values can also be overridden by the anonuid and anongid options. Finally, you can map all user requests to the anonymous uid by specifying the all_squash option.

and further

all_squash: Map all uids and gids to the anonymous user.

Actually we do map them: To our default user доступ having uid = 1002, group доступ gid 1003 !

So there probably is a more simple solution possible.
There is always room for improvement.

constructive comments welcome.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .