Advanced Network and System Administration

Transcription

1 Advanced Network and System Administration NFS HaiVDC 1

2 Topics 1. NFS Versions 2. Using NFS 3. NFS Services 4. Server and Client Configuration 5. Automounter 6. Security 7. Performance HaiVDC 2

3 NFS Verions v2 (1984) UDP 32-bit v3 (1992) TCP 64-bit. v4 (2000) Distributed, x-platform, security. HaiVDC 3

4 Using NFS Client 1. Start portmap Mount filesystems. Server 1. Start portmap 2. Start nfs services. 3. Configure exports. 4. Export filesystems. HaiVDC 4

5 NFS Services portmap RPC service for Linux portmap nfs NFS file server processes. rpc.mountd rpc.rquotad nfsd nfslock Optional file locking service. rpc.statd HaiVDC 5

6 NFSv2/3 Processes rpc.mountd Handles client mount requests. rpc.nfsd NFS server processes. rpc.lockd Process for optional nfslock service. rpc.statd Handles server crashes for nfslock. rpc.rquotad Quotas for remote users. HaiVDC 6

7 rpcinfo > rpcinfo -p program vers proto port tcp 111 portmapper udp 111 portmapper udp nlockmgr tcp nlockmgr udp 819 rquotad udp 819 rquotad tcp 822 rquotad tcp 822 rquotad udp 2049 nfs udp 2049 nfs tcp 2049 nfs tcp 2049 nfs udp 836 mountd tcp 839 mountd udp 836 mountd tcp 839 mountd Copyright@2009, HaiVDC 7

8 NFSv4 Processes nfsd NFSv4 server processes. Handles mounts. rpc.idmapd Maps NFSv4 names and local UIDs and GIDs. Uses /etc/idmapd.conf. rpc.svcgssd Server transport Kerberos auth. rpc.gssd Client transport Kerberos auth. HaiVDC 8

9 Server Configuration 1. Configure /etc/exports List filesystems to be exported. Specify export options (ro, rw, etc.) Specify hosts/networks to export to. 1. Export filesystems. exportfs 1. Start NFS server (if not already started) service portmap start service nfs start HaiVDC 9

10 /etc/exports Format: directory hosts(options) Options ro, rw Read-only, read-write. async Server replies before write. sync Save before reply (default) all_squash Map all users to anon UID/GID. root_squash Map root to anon UID (default) no_root_squash Don t map root (insecure.) anon{uid,gid} Set anonymous UID, GID. Examples: /home *.example.com(rw,sync) /backups /24(ro,all_squash) /ex/limited foo.example.com Copyright@2009, HaiVDC 10

11 Client Configuration Manual mounting mount -t <nfs-type> -o <options> server:/remote/export /local/directory Mounting via /etc/fstab server:/remote/export /local/directory <nfs-type> <options> 0 0 NFS Type is either nfs or nfs4. Copyright@2009, HaiVDC 11

12 Mount Options hard or soft Error handling hard: NFS requests will uninterruptible wait until server back. soft: NFS requests will timeout and report failure. intr NFS requests can be interrupted if server unreachable. nfsvers=2,3 NFS protocol version (not 4) noexec Prevents execution of binaries. nosuid Disables setuid for security. rsize,wsize=# NFS data block size (default 8192) sec=mode NFS security type. sys uses local UIDs and GIDs. krb5 uses Kerberos5 authentication. krb5i uses Kerberos5 authentication + integrity checking krb5p uses Kerberos5 auth + integrity checking + encryption. tcp, udp Specifies protocol to use for mount. Copyright@2009, HaiVDC 12

13 Automounter Manages NFS mounts Automounter maps vs /etc/fstab. Mounts filesystems only when needed: Makes administering many filesystems easier. Improves startup speed. Provides uniform namespaces. Ex: mounts /home/home7 as /home on login. /etc/auto.master points to maps /home /etc/auto.home Maps describe mounts * -fstype=nfs4,soft,intr,nosuid server:/home Copyright@2009, HaiVDC 13

14 Security Limit which hosts have access to fs. Specify hosts in /etc/exports. Use iptables to limit which hosts can use nfs. Use read-only mounts unless need writes. Disable suid and execution unless needed. Map root to nobody. Map all users to specific user by default. Block NFS at network firewalls. Use NFSv4 with Kerberos. HaiVDC 14

15 Performance Measuring performance nfsstat /proc/net/rpc/nfsd Optimizations Increase the block size. Problem: fragments? Set the async option on mounts. Faster network card. Faster disk array. NVRAM cache on array to save NFS writes. HaiVDC 15

16 References 1. Michael D. Bauer, Linux Server Security, 2 nd edition, O Reilly, Mike Eisler, Ricardo Labiaga, Hal Stern, Managing NFS and NIS, 2 nd edition, O Reilly, Aeleen Frisch, Essential System Administration, 3 rd edition, O Reilly, Evi Nemeth et al, UNIX System Administration Handbook, 3 rd edition, Prentice Hall, NFS HOWTO, 6. RedHat, Red Hat Enterprise Linux 4 System Administration Guide, Manual/sysadmin-guide/, RedHat, Red Hat Enterprise Linux 4 Reference Guide, Manual/ref-guide/ch-nfs.html, Copyright@2009, HaiVDC 16