Hi,
I have an NFS mount on a Solaris 10 server with file permissions nobody:nobody. This is an NFS export from an Netapp filer. Export attributes from the filer are below.
Anonymous User ID=0
Read-Write Access (All Hosts)
Security (sys)
I have other NFS exports set up with the same attributes and there is no problem with them.
Is there something I need to change on the server side to be able to change these permissions? Please help:(
Thanks in advance.
You will need to share out your "resources" from the nfs server with correct entries, permissions under /etc/dfs/dfstab file
checkout the manpage for share_nfs(1M)
example: share -F nfs -o root=hostname,anon=0 /dir
Put anon=0 after the root=hostname
anon=0 means "export with root access to all hosts the fs is exported
to"
If "root=hostname" doesn't work, then you've used the wrong hostname
and would possibly need to use the FQDN instead. (You can now remove
the root=hostname option
Hi Incredible,
Unfortunately the export is coming from a NetApp filer. So I can't edit any of those files you suggested.
I have other NFS shares with the same attributes shared out to other servers with no permission issues.
I have tried mounting an NFS share from the NetApp filer that has no permission issue on another server, on to this solaris 10 server and it mounts with the nobody:nobody permissions. So it must be a setting somewhere on the client thats causing this? Any help is greatly appreciated. Thanks.
cat /etc/default/nfs (show ouput)
The only thing today that prevents the scenario is to use Kerberos V5 (or some other strong authentication system, but Kerberos V5 is what most vendors have) authentication in the NFS traffic itself. This means exporting the volume with option sec=krb5 (or krb5i, or krb5p), and without anon=0 and without root=.
What happens is that even if the attacker su'es to someuser, unless he knows someuser's Kerberos password, he cannot become user someuser over the NFS connection. Even attempting to access /home/someuser as super-user, even with Kerberos credentials for super-user, is defeated, because super-user, uid 0, will be mapped to user nobody (since anon=0 and root= are absent in the export options).
And are you using NFS v4 ?
I am using NFS version 4. Here is the /etc/default/nfs file.
# cat /etc/default/nfs
# ident "@(#)nfs 1.10 04/09/01 SMI"
#
# Copyright 2004 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
# Sets the maximum number of concurrent connection oriented connections.
# Default is unlimited and is obtained by not setting NFSD_MAX_CONNECTIONS.
# Equivalent to -c.
#NFSD_MAX_CONNECTIONS=
# Set connection queue length for the NFS over a connection-oriented
# transport. The default value is 32 entries.
# Equivalent to -l.
NFSD_LISTEN_BACKLOG=32
# Start NFS daemon over the specified protocol only.
# Equivalent to -p, ALL is equivalent to -a on the nfsd command line.
# Mutually exclusive with NFSD_DEVICE.
NFSD_PROTOCOL=ALL
# Start NFS daemon for the transport specified by the given device only.
# Equivalent to -t.
# Mutually exclusive with setting NFSD_PROTOCOL.
#NFSD_DEVICE=
# Maximum number of concurrent NFS requests.
# Equivalent to last numeric argument on nfsd command line.
NFSD_SERVERS=16
# Set connection queue length for lockd over a connection-oriented transport.
# Default and minimum value is 32.
LOCKD_LISTEN_BACKLOG=32
# Maximum number of concurrent lockd requests.
# Default is 20.
LOCKD_SERVERS=20
# Retransmit Timeout before lockd tries again.
# Default is 5.
LOCKD_RETRANSMIT_TIMEOUT=5
# Grace period in seconds that all clients (both NLM & NFSv4) have to
# reclaim locks after a server reboot. Also controls the NFSv4 lease
# interval.
# Overrides the deprecated setting LOCKD_GRACE_PERIOD.
# Default is 90 seconds.
GRACE_PERIOD=90
# Deprecated.
# As for GRACE_PERIOD, above.
# Default is 90 seconds.
#LOCKD_GRACE_PERIOD=90
# Sets the minimum version of the NFS protocol that will be registered
# and offered by the server. The default is 2.
#NFS_SERVER_VERSMIN=2
# Sets the maximum version of the NFS protocol that will be registered
# and offered by the server. The default is 4.
#NFS_SERVER_VERSMAX=4
# Sets the minimum version of the NFS protocol that will be used by
# the NFS client. Can be overridden by the "vers=" NFS mount option.
# The default is 2.
#NFS_CLIENT_VERSMIN=2
# Sets the maximum version of the NFS protocol that will be used by
# the NFS client. Can be overridden by the "vers=" NFS mount option.
# If "vers=" is not specified for an NFS mount, this is the version
# that will be attempted first. The default is 4.
#NFS_CLIENT_VERSMAX=4
# Determines if the NFS version 4 delegation feature will be enabled
# for the server. If it is enabled, the server will attempt to
# provide delegations to the NFS version 4 client. The default is on.
#NFS_SERVER_DELEGATION=on
# Specifies to nfsmapid daemon that it is to override its default
# behavior of using the DNS domain, and that it is to use 'domain' as
# the domain to append to outbound attribute strings, and that it is to
# use 'domain' to compare against inbound attribute strings.
#NFSMAPID_DOMAIN=domain
#
Change this entry similar to the one shown below:
NFSMAPID_DOMAIN=netapp-sush
Thanks for that Incredible. I will try that.
Just as a point the other servers that have no problems with nfs mounts are using nfsv3. I have read on the web that some versions of Data Ontap have problems with Sol10 NFSv4.
I will try this entry and see if it works. Hopefully it does. Thanks for your help. Much appreciated:)