NFS file sharing

Summary from the book "Linux O & M path" by Ding yiming

Network File System (NFS) is a network file system. It is a general sharing solution developed by Sun to share file systems over a network. Currently, three versions of NFS are available: nfsv2, nfsv3, and nfsv4. In centos6.5, nfsv4 is used by default, and NFS listening is on port tcp2049.

In Linux, access information management can be managed by a specific server or delegated to RPC (Remote Procedure Call) to help you manage the access information. The RPC protocol is used by remote communication programs to manage the basic information required by both parties. In this way, the NFS service can focus on how to share data, this is delegated to RPC Management. The centos6.5 system is supported by the rpcbind service. Although nfsv4 does not need to directly interact with rpcbind, RPC. moundtd is still a required service of nfsv4. Therefore, nfs-utils and rpcbind are required.

The NFS server uses the/etc/exports configuration file to set which clients can access which NFS shared file systems. Format: shared path client HOST 1 (option) client host 2 (option )......

The client host can be a network segment, a single host, or a host name.

You do not need to set the options. Use the default Ro, sync, wdelay, and root_squash. Specific options

RO: Read-Only shared directory;

RW: shared directory readable and writable;

All_squash: All Access Users are mapped to anonymous users or user groups;

No_all_squash (default): the access user first matches the local user, and then maps to an anonymous user or user group after the matching fails;

Root_squash (default): maps the accessed root user to an anonymous user or user group;

No_root_squash: the visiting root user maintains the root account permission;

Anonuid = <uid>: Specifies the UID of the local user accessing the user anonymously. The default value is nfsnobody (65534 );

Anongid = <GID>: Specifies the GID of the local user group for anonymous access. The default value is nfsnobody (65534 );

Secure (default): restrict the client to connect to the server from a TCP/IP Port less than 1024;

Insecure: allows the client to connect to the server from a TCP/IP Port greater than 1024;

Sync: write data synchronously to the memory buffer and disk, which is less efficient, but can ensure data consistency;

Async: stores data in the memory buffer before writing data to the disk if necessary;

Wdelay (default): Check whether there are related write operations. If yes, execute these write operations together to improve efficiency;

No_wdelay: if there is a write operation, it will be executed immediately and should be used with sync;

Subtree_check (default): If the output directory is a sub-directory, the NFS server checks the permissions of its parent directory;

No_subtree_check: even if the output directory is a sub-directory, the NFS server does not check the permissions of its parent directory, which improves the efficiency;

Case:

Among them,/var/web/can be asynchronously written by 192.168.118.250, and the root user's access to the web directory is not blocked./var/cloud can be accessed synchronously by any host. Configuration details:

[[Email protected] tempal] # Yum-y install nfs-utils rpcbind

Loaded plugins: fastestmirror, refresh-packagekit, security

Loading mirror speeds from cached hostfile

* Base: mirrors.163.com

* Extras: mirrors.aliyun.com

* Updates: mirrors.hust.edu.cn

Setting up install process

Package 1: nfs-utils-1.2.3-39.el6.i686 already installed and latest version

Package rpcbind-0.2.0-11.el6.i686 already installed and latest version

Nothing to do

[[Email protected] tempal] # rpm-Qa | grep nfs-utils

Nfs-utils-lib-1.1.5-6.el6.i686

Nfs-utils-1.2.3-39.el6.i686

[[Email protected] tempal] # rpm-Qa | grep rpcbind

Rpcbind-0.2.0-11.el6.i686

[[Email protected] tempal] # useradd-u 1003 Jerry

[[Email protected] tempal] # mkdir/var/{web, cloud}

[[Email protected] tempal] # chmod A + w/var/Web

[[Email protected] tempal] # Vim/etc/exports

[[Email protected] tempal] # Cat/etc/exports

/Var/web/192.168.118.250 (RW, async, no_root_squash)

/Var/cloud/192.168.118.0/255.255.255.0 (RO, sync)

[[Email protected] tempal] #/etc/init. d/rpcbind restart

Stopping rpcbind: [OK]

Starting rpcbind: [OK]

[[Email protected] tempal] #/etc/init. d/nfs restart

Shutting down NFS daemon: [failed]

Shutting down NFS mountd: [failed]

Shutting down NFS quotas: [failed]

Shutting down RPC idmapd: [failed]

Starting NFS services: [OK]

Starting NFS quotas: [OK]

Starting NFS mountd: [OK]

Starting NFS daemon: [OK]

Starting RPC idmapd: [OK]

[[Email protected] tempal] # chkconfig rpcbind on

[[Email protected] tempal] # chkconfig NFS on

[[Email protected] tempal] # showmount-e 192.168.118.253

Export list for 192.168.118.253:

/Var/cloud 192.168.118.0/255.255.255.0

/Var/Web 192.168.118.250

The client 192.168.118.254 is set to read-only. The default root permission is automatically mapped to the nfsnobody account, and the general account permission is retained. Specific operations:

[Email protected]: ~ $ Sudo Su

[Sudo] password for tempal:

[Email protected]:/home/tempal # mkdir/var/cloud

[Email protected]:/home/tempal # useradd-u 1003 Jerry

[Email protected]:/home/tempal # Mount 192.168.118.253:/var/cloud

[Email protected]:/home/tempal # cd/var/cloud

[Email protected]:/var/cloud # Touch root.txt

Touch: Unable to create "root.txt": Read-Only File System

Set 192.168.118.250 on the client. It can be read and written by default and has a root account. Specific operations:

[[Email protected] tempal] # Yum-y install nfs-utils rpcbind

Loaded plugins: fastestmirror, refresh-packagekit, security

Determining fastest mirrors

* Base: mirrors.hust.edu.cn

* Extras: mirrors.hust.edu.cn

* Updates: mirrors.hust.edu.cn

Base | 3.7 KB

Base/primary_db | 3.5 MB

Extras | 3.4 kb: 00

Extras/primary_db | 18 KB: 00

Updates | 3.4 kb: 00

Updates/primary_db | 3.4 MB

Setting up install process

Package 1: nfs-utils-1.2.3-39.el6.i686 already installed and latest version

Package rpcbind-0.2.0-11.el6.i686 already installed and latest version

Nothing to do

[[Email protected] tempal] # showmount-e 192.168.118.253

Export list for 192.168.118.253:

/Var/cloud 192.168.118.0/255.255.255.0

/Var/Web 192.168.118.254

[[Email protected] tempal] # mkdir/var/Web

[[Email protected] tempal] # useradd-u 1003 Jerry

[[Email protected] tempal] # Mount 192.168.118.253:/var/web/var/Web

[[Email protected] tempal] # chmod A + w/var/Web

[[Email protected] tempal] # cd/var/Web; touch centos_test.txt

[[Email protected] Web] # ll/var/web/

Total usage 0

-RW-r --. 1 Root 0 June 22 00:37 centos_test.txt

[[Email protected] Web] # Su-Jerry

[[Email protected] ~] $ CD/var/web/

[[Email protected] Web] $ touch jerry.txt

[[Email protected] Web] $ LS-l

Total usage 0

-RW-r --. 1 Root 0 June 22 00:37 centos_test.txt

-RW-r --. 1 jerry 0 June 22 00:38 jerry.txt

Advanced NFS settings:

(1) NFS service process

NFS: the main process of the NFS service.

Nfslock: provides a lock mechanism for the NFS file system.

Rpcbind: Provides address and port registration services.

Rpc. mountd: used by NFS to process mount requests of nfsv2 and nfsv3

Rpc. nfsd: dynamically process client requests

Lockd: lockd is a kernel thread that runs on the server and client to implement the NLM network protocol and allows the nfsv2 and nfsv3 clients to lock files.

Rpc. statd: This process implements the network status monitoring (NSM) protocol.

Rpc. rquotad: This process provides user quota information.

Rpc. idmapd: Provides nfsv4 name ing./etc/idmapd. conf is its configuration file.

(2) NFS client Configuration

Mainly the mount command

# Mount-T nfs-O option service host:/Server shared directory/local Mount directory

The Mount options are as follows:

Ro is loaded in read-only mode.

RW can be loaded in read/write mode.

Sync synchronizes the input and output operations of the file system.

Async executes the input and output operations of the file system in non-synchronous mode.

Defaults uses the default option. The default options are RW, SUID, Dev, exec, Anto nouser, and async.

Atime updates the inode access time for each access. The default value is "noatime.

Noatime does not update the inode access time for each access.

The characters or block devices on the dev readable file system. The undo option is nodev.

Nodev does not read characters or block devices on the file system.

Exec: executable binary file. The cancel option is noexec.

Noexec cannot execute binary files.

Auto must specify this option in the/etc/fstab file. When the-a parameter is executed, the device set to auto is loaded, and the noauto parameter is deselected.

Noauto cannot use the-a parameter for loading.

SUID: Start set-user-identifier (Set User ID) and set-group-identifer (set group ID). The cancel option is nosuid.

Nosuid: Disable set-user-identifier (Set User ID) and set-group-identifer (set group ID.

Normal users can perform the loading operation.

Normal nouser users cannot perform the loading operation. The default setting is used.

Remount reloads the device. It is usually used to change the configuration status of a device.

Rsize: the buffer size for reading data. The default value is 1024.

Wsize: data buffer size. The default value is 1024.

Previously, FG was used to perform the mounting operation. The default settings are as follows. If the Mount fails, the normal operation response is affected.

BG mounts the instances later.

Hard mounting, which is set by default. If the communication with the server fails, the attempt to access the server is blocked until the server recovers.

Soft mount. If the communication on the server fails, an error message is returned if the attempt to access the server fails. This feature is very useful for preventing the process from being "Hung" in unrelated installation operations.

Retrans = n specifies the number of times requests are repeatedly sent before an error message is returned on a soft-installed file system.

Nointr does not allow user interruption. It is set by default.

Intr allows users to interrupt blocked operations (and allows them to return an error message ).

Timeo = n sets the request timeout (in the unit of 10 seconds ).

TCP: Mount using the TCP protocol

UDP: Mount with UDP

Note:

Automounter special parameters

Fstype = specifies the type of a file system (if the file system to be mounted is not NFS), Mount is not available.

You can also use autofs for automatic mounting.

Centos installation: [[email protected] ~] # Yum-y install autofs

Ubuntu installation: [email protected]:/var/cloud # apt-Get install autofs

Edit the main configuration file/etc/auto. Master and add the directory information to be mounted at the end.

Format: Mount configuration file name corresponding to the local Mount main directory-mount parameters

Mount parameters are the same as Mount parameters. Multiple parameters are separated by commas. The Mount parameters here can overlap with the parameters defined in the corresponding loading configuration file.

Example:

Vim/etc/auto. Master

# The local Mount directory is/var/web, and the corresponding loading configuration file is/etc/auto. NFS. -- timeout parameter. The default value is 600 seconds (10 minutes ).

/Var/web/etc/auto. NFS -- timeout = 600

Save and exit

Edit and load the configuration file to add the file system to be mounted.

Format: Mount directory-mount parameter mounting File System

Mount parameters are the same as Mount parameters. Multiple parameters are separated by commas.

Example:

Vim/etc/auto. NFS

Web-RW, BG, soft, rsize = 32768, wsize = 32768, nosuid, noexec, nodev 192.168.118.253:/var/Web

Save and exit

Restart autofs

/Etc/init. d/autofs restart

Automatic startup

[[Email protected] ~] # Chkconfig autofs on

(3) using NFS command tools

Exportfs command: allows the root user to share or cancel some shared directories without restarting the NFS service.

Option:-R: re-read the/etc/exportfs file.

-A: Share all or cancel sharing all

-U cancel sharing. If you use it with-a, you can cancel all the file systems shared.

-V: Show Details

Nfstat command: View NFS sharing status

-S, -- server only displays the server status. Both the server and the client are displayed by default.

-C, -- client only displays the client status

-N numbers 2, 3, and 4, indicating the NFS Version Number

Rpcinfo command: Generate RPC Information Report

-M: displays mounting information.

-L display information in the form of a list

-M: displays the rpcbind operation information table of the specified host.

-P: displays the RPC registration information of the specified host.

-S: displays all the information programs registered with RPC on the specified host. If no host is specified, local information is displayed by default.

(4) Run NFS at the backend of the firewall

Run the command rpcinfo-P to check port usage:

We can see that NFS occupies port 2049, Portmapper occupies port 111, rquotad occupies port 875, and mountd and nlockmgr occupy ports not fixed. Set the two processes with ports not fixed to fixed.

# Vim/etc/services

MOUNTD 39102/tcp # mountd add by temapl

MOUNTD 39102/udp # mountd add by temapl

Nlockmgr 41393/tcp # nlockmgr add by tempal

Nlockmgr 41393/udp # nlockmgr add by tempal

 

Restart the NFS service: Service NFS restart

Edit route table

# Vim/etc/sysconfig/iptables

Add content at the bottom

-A input-s 192.168.118.0/24-M state -- state new-p tcp -- dport 111-J accept

-A input-s 192.168.118.0/24-M state -- state new-p tcp -- dport 875-J accept

-A input-s 192.168.118.0/24-M state -- state new-p tcp -- dport 2049-J accept

-A input-s 192.168.118.0/24-M state -- state new-p tcp -- dport 39102-J accept

-A input-s 192.168.118.0/24-M state -- state new-p tcp -- dport 41393-J accept

-A input-s 192.168.118.0/24-M state -- state new-p udp -- dport 111-J accept

-A input-s 192.168.118.0/24-M state -- state new-p udp -- dport 875-J accept

-A input-s 192.168.118.0/24-M state -- state new-p udp -- dport 2049-J accept

-A input-s 192.168.118.0/24-M state -- state new-p udp -- dport 39102-J accept

-A input-s 192.168.118.0/24-M state -- state new-p udp -- dport 41393-J accept

Restart the firewall: Service iptables restart