0

I do not get the expected file permissions from my Lan Server using NFS4.

Mounting the 'exports' dir as a client works fine. ls outputs the correct folder content. But if the client tries to cd into a dir, he gets a "Permission denied".

If the client uses ls -l to list the content of the mounted folder, he gets GID:UID numbers for the owner of each file. I was expecting NFS4 to give the client username:groupname as a string not as a number. The shown UIDs do not match the UID of the client user. I think this is why I get "permission denied".

I have a user 'Paul'(UID=1004) on the server and a user 'Paul'(UID=1000) on the client. I'd like to handle NFS4 file permissions by the names NOT by the IDs.

This is the current setup:

Mounting as client:

how I mount the exports on the Ubuntu 14.04 client:

sudo mount.nfs4 192.168.178.10:/ /fs_data -o soft,intr,rsize=8192,wsize=8192

NFS Server Setup:

all the changes that I made to the NFS4 server on Raspbian, after installing 'nfs-kernel-server', 'rpcbind', 'nfs-common'

/etc/default/rpcbind

OPTIONS=""

/etc/hosts.deny

rpcbind:ALL

/etc/hosts.allow

rpcbind: 192.168.178.20 , 192.168.178.21

/etc/default/nfs-kernel-server

NEED_SVCGSSD=NO

/etc/default/nfs-common

NEED_IDMAPD=YES
NEED_GSSD=no

/etc/exports

/exports         192.168.178.20(rw,sync,fsid=0,crossmnt,no_subtree_check,no_root_squash,insecure) 192.168.178.21(rw,sync,fsid=0,crossmnt,no_subtree_check,no_root_squash,insecure)
/exports/paul    192.168.178.20(rw,sync,no_subtree_check,no_root_squash,insecure) 192.168.178.21(rw,sync,no_subtree_check,no_root_squash,insecure)

Any clue, what I'm missing?

2

I think this is a trap in nfs4 a lot of people were faced, including me.In nfs4 you specify a sec= flavor and when not specified the default is AUTH_SYS which means sending local UIDs and GIDs to the server which are then compared.

As far as I understood it, only when using a security flavor of the krb5* family the client sends the authentication as a string with <username>:<groupname>

Here is a more detailed explanation what happens behind the scenes.

In the manpage of nfs, there is also a section "Using non-privileged source ports" which mentions that if the server accepts non-priviledged ports any user could pretend an identity and sounds like a security issue one could use as a workaround. But I don't know if that is that easy or if it needs some hacks to make it usable. But, in the end it is still an security issue.

Maybe the easiest way is to keep the UIDs and GIDs in sync manually or set up a simple NIS or LDAP. And when using sssd you also could cache the login credentials from NIS or LDAP but the user has to login once connected with the server reachable.

  • This really is a trap! I was stuck there for two evenings... This is sad news.. I will sync the IDs manually for now.. :-( Kerberos seems to much of a hassle. Maybe I'll have a look on NIS or LDAP - haven't heard about that yet, though.. Thanks for clarifying this! I would give you an upvote but I can't ;-) – Rotareti Feb 4 '16 at 20:12
  • PS: There is a bug ticket on launchpad on this: bugs.launchpad.net/ubuntu/+source/nfs-utils/+bug/966734 – Rotareti Feb 4 '16 at 20:18
  • Oh yes, it also took me some time to dig into...but it's hard to tell if it is a bug or not. Think of a network with NFS server and a lot of NFS clients which have out-of-sync UIDs and GIDs. This is not only a security issue, but also could lead to a completely messed up file ownerships on the network. As long as the users are working on the same workstation the UID will be OK, but if they change the workstation and have a different UID for their username, they cannot access their files anymore. On the other hand, someone else could easily get your files that way which is also true for NFSv3. – Thomas Feb 4 '16 at 22:47
  • 1
    Yeah, it seems for the better to not use it unproper. I just wonder why there is so little information on this. There are many tutorials that tell you how to setup NFS4 without Kerberos etc. but none tells you that the id-name mapping will not work. – Rotareti Feb 4 '16 at 23:52

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.