NFS - Distributed File System

The Network File System (NFS) is a distributed file system protocol whose purpose is to let a client host access files on a server over the network as if accessing local storage.

NFS relies on the RPC protocol during file or data transfer. RPC (Remote Procedure Call) is a mechanism that lets a client execute a program on another system. NFS itself does not provide any protocol or functionality for transferring information, but NFS still lets us share data over the network because it makes use of other transport protocols, and those transport protocols use this RPC functionality. You could say NFS itself is a program that uses RPC — or that NFS is also an RPC SERVER. So wherever NFS is used, the RPC service must be started, whether it’s an NFS SERVER or an NFS CLIENT. Only this way can the SERVER and CLIENT map PROGRAM to PORT via RPC. You can think of the relationship between RPC and NFS this way: NFS is a file system, while RPC is responsible for transporting information.

Installation

  • Server side

apt-get install nfs-kernel-server nfs-common

  • Client side

apt-get install nfs-common

Usage

Server-side configuration

Configuration file: /etc/exports [1]

Format: [shared directory] [client(parameter1,parameter2)]

The client refers to a machine on the network that can access this NFS exported directory. Common ways to specify a client:

  • A host with a specific IP address: 192.168.0.200

  • All hosts in a given subnet: 192.168.0.0/24 or 192.168.0.0/255.255.255.0

  • All hosts: *

Parameter options are used to set the exported directory’s access permissions, user mapping, etc.

Access permission options:

  • Set the exported directory as read-only: ro

  • Set the exported directory as read-write: rw

User mapping options:

  • all_squash: regardless of which NFS user it is, their identity is restricted to a specified ordinary user identity;

  • no_all_squash: the opposite of all_squash (default setting);

  • root_squash: the root user does not get elevated permissions on the shared directory, only ordinary-user permissions, i.e. root is restricted (default setting);

  • no_root_squash: the root user has full control over the shared directory, just as if operating on a local directory.

  • anonuid/anongid: used together with root_squash and all_squash, to specify the restricted uid and gid for NFS users

Other options:

  • secure: restricts clients to connecting to the NFS server only from TCP/IP ports below 1024 (default setting);

  • insecure: allows clients to connect to the server from TCP/IP ports above 1024;

  • sync: writes data synchronously to both the memory buffer and disk — low efficiency, but ensures data consistency;

  • async: first stores data in the memory buffer, only writing to disk when necessary (recommended setting);

  • wdelay: checks for related write operations, and if there are any, executes them together to improve efficiency (default setting);

  • no_wdelay: executes write operations immediately; should be used together with sync;

  • subtree: if the exported directory is a subdirectory, the NFS server checks the permissions of its parent directory;

  • no_subtree: even if the exported directory is a subdirectory, the NFS server does not check the permissions of its parent directory, which improves efficiency (default setting);

Commands

showmount -e [ipaddress]: view the server’s shared resources from the client

exportfs -auv: unmount all shared directories

exportfs -arv: re-share all directories

Example

Assume a Unix-style scenario, where one machine (the client) needs to access data stored on another machine (the NFS server):

  1. The server implements the NFS daemon, running nfsd by default, so that data can be accessed by clients

2. 服务端系统管理员可以决定哪些资源可以被访问, 导出目录的名字和参数, 通常使用 /etc/exports 配置文件 和 exportfs 命令。

/home/client1           192.168.0.101(rw,async,no_subtree_check)
/var/www                192.168.0.101(rw,async,fsid=0,crossmnt,no_subtree_check,no_root_squash)

  1. The server-side security administrator ensures it can organize and authenticate legitimate clients.

  2. The server’s network configuration ensures it can negotiate with clients through the firewall.

5. 客户端请求导出的数据, 通常调用一个 mount 命令. (The client asks the server (rpcbind) which port the NFS server is using, the client connects to the NFS server (nfsd), nfsd passes the request to mountd)

mount 192.168.0.100:/home/client1 /mnt/nfs/home/client1
mount 192.168.0.100:/var/www /var/www

6. 如果一切顺利, 客户端的用户就可以通过已经挂载的文件系统查看和访问服务端的文件了.

7.启动时挂载NFS

vi /etc/fstab
192.168.0.100:/home/client1  /mnt/nfs/home/client1  nfs4   rsize=8192,wsize=8192,timeo=14,bg,_netdev 0 0
192.168.0.100:/var/www  /var/www   nfs4   rsize=8192,wsize=8192,timeo=14,bg,_netdev 0 0

References