NFS

NFS - Network File Systems is an open standard created in 1984 by Sun Microsystems, it lets you share filesystems amount computers.

Goal of a network file services

• grant shared access to files and directories that are stored on the disks of remote systems
• User applications must be able to read and write to these files with the same system calls they use for local files
• If more than one network client or application attempts to modify a file simultaneously, the file sharing service must resolve any conflicts that arise

Server Message Block (SMB) protocol underlies the file sharing capabilities built into Windows and macOS. UNIX and Linux can also speak SMB by running the Samba add-on package.

Important

NFS is most commonly used in shops where UNIX and Linux are predominant. Even in these environments, SMB remains a plausible option

SMB and NFS are both solid protocols and we can be confident they’re not going anywhere.

State

A server that records the status of files and clients is said to be stateful; one that doesn’t is stateless.

Stateful servers keep track of all open files across the network. This mode of operation introduces many layers of complexity (more than you might expect) and makes recovery in the event of a crash far more difficult.

On a stateless server, each request is independent of the requests that have preceded it. If either the server or the client crashes, nothing is lost in the process. Under this design, it is painless for servers to crash or reboot, since they do not maintain any context. However, it’s impossible for the server to know which clients have opened a file for writing, so it cannot manage concurrency.

NFSv4 is stateful both client and server maintain informatino about open files and locks.

NFSv4 is the only verison you should use now, any lower version has different config and much worse security.

Exports

An NFS server is said to “export” a directory when it makes the directory available for use by other machines. In windows this is called a “share”.

Authentication (v4)

This section only covers NFSv4, cause no one should use v3 anymore if possible.

There are two RPC security modes: AUTH_SYS and RPCSEC_GSS.

AUTH_SYS

The client sends its raw UID/GID with every request and the server just uses those numbers for a normal permission check (file owner, group, mode bits). No password or proof of identity anywhere - authorization without authentication. Root on the client can su to any UID and impersonate that user.

Since the check is purely numeric, UIDs must be synchronized across client and server (LDAP/NIS). If they drift, access is silently wrong: UID 1000 = alice on the client but bob on the server means alice gets bob’s files and is denied her own.

Root squashing softens this: the server rewrites incoming UID 0 to “nobody” (traditionally UID 65534 / -2), so remote root is not local root. It’s a mitigation only - every other UID is still trusted blindly.

RPCSEC_GSS + Kerberos

The client presents a Kerberos ticket and the server verifies it against the KDC. This is real authentication, but it requires client and server to share a Kerberos realm. NFSv4 makes support for it mandatory, and it can optionally add integrity checking and encryption on top.

Note

NFSv4 identity mapping (user@nfs-domain) is for display and attributes only (stat, chown, ls -l) - it plays no role in access control. ls -l can show the right names while the server checks mismatched numbers underneath.

nfsd

Serverside NFS daemon on 2049.

nfsd runs on the server the whole time, servicing NFS RPCs (remote procedure calls) on port 2049. The client’s kernel translates normal file syscalls into those RPCs, so apps on the client access files like any local filesystem.

Client-side NFS

• NFS filesystems are mounted in much the same way as local disk filesystems.
• The mount command understands the notation hostname:directory to mean the path directory on the host hostname.
• As with local filesystems, mount maps the remote directory on the remote host into a directory within the local file tree

mount

sudo mount -o rw,hard,intr,bg server:/ nfs/ben

# breakdown
-o                "options follow" — the comma-list below
   rw             read-write access
   hard           if server dies, block/retry forever till it's back
                  (opposite: soft, which errors out risks data loss!)
   bg             if the first mount attempt fails, retry in the
                  background instead of hanging the foreground
server:/          what to mount — host "server", its exported path "/"
nfs/ben           where to mount it — local mountpoint dir

umount

umount works on NFS filesystems just like it does on local filesystems. If the NFS filesystem is in use when you try to unmount it, you get an error such as

Mounting remote filesystems at boot

You can use the mount command to establish temporary network mounts, but you should list mounts that are part of a system’s permanent configuration in /etc/fstab so that they are mounted automatically at boot time.

This method however fails with scale when you need to manage more machines or have changing file storage servers/layouts

Automounter daemons

A daemon that mounts filesystems when referenced and unmounts them when idle. autofs is the kernel driver: it watches for a mount request, pauses the caller, has the automounter mount the target, then returns control.

Transparent to users - instead of mirroring a real filesystem, the automounter builds a virtual hierarchy from its config (maps). Touch a directory in it and automountd intercepts the reference and mounts the real filesystem behind it.

Why maps beat an fstab copied across hosts:

• Centralized - serve maps from LDAP/NIS; update one place, every client follows. No per-host drift.
• Executable - a map can be a script that generates the layout on the fly (the “phone home” trick).
• Wildcards + vars - * server:/export/home/& covers every home dir; ${HOST}, ${ARCH} vary per machine.
• Replicated - list several servers for a read-only mount; the automounter picks one that’s up (cheap failover).
• On-demand - mounts on reference, unmounts when idle, so a dead server doesn’t hang boot like a hard fstab mount.

Pithy

A map is a lookup table: key = a path, value = what to mount there. fstab says “mount everything now”; a map says “mount this if someone touches the path”.

This is clearly the superior way to do this outside of one or two pcs and one mount.

Privileged ports

Some NFS servers may insist that requests come from a privileged port (a port numbered lower than 1,024). The logic is the server only wants privillaged clients to be able to connect an NFS (I don’t really get this and seems bad to force clients to run with privilage.)

Under Linux, you can accept mounts from unprivileged ports with the insecure export option.

NFSStat

nfsstat displays various statistics maintained by the NFS system.

• nfsstat -s shows server-side statistics
• nfsstat -c shows information for client-side operations