NFS mount. Nobody Nobody permissions. | Unix Linux Forums | Solaris

  Go Back    


Solaris The Solaris Operating System, usually known simply as Solaris, is a Unix-based operating system introduced by Sun Microsystems. The Solaris OS is now owned by Oracle.

NFS mount. Nobody Nobody permissions.

Solaris


Closed Thread    
 
Thread Tools Search this Thread Display Modes
    #1  
Old 09-24-2008
gwhelan gwhelan is offline
Registered User
 
Join Date: Jun 2008
Last Activity: 8 March 2009, 9:12 AM EDT
Posts: 40
Thanks: 0
Thanked 0 Times in 0 Posts
NFS mount. Nobody Nobody permissions.

Hi,

I have an NFS mount on a Solaris 10 server with file permissions nobody:nobody. This is an NFS export from an Netapp filer. Export attributes from the filer are below.

Anonymous User ID=0
Read-Write Access (All Hosts)
Security (sys)

I have other NFS exports set up with the same attributes and there is no problem with them.

Is there something I need to change on the server side to be able to change these permissions? Please help

Thanks in advance.
Sponsored Links
    #2  
Old 09-24-2008
incredible incredible is offline Forum Advisor  
Registered User
 
Join Date: May 2008
Last Activity: 1 June 2012, 4:25 AM EDT
Location: SINGAPORE.. The "FINE" City
Posts: 2,693
Thanks: 1
Thanked 19 Times in 19 Posts
You will need to share out your "resources" from the nfs server with correct entries, permissions under /etc/dfs/dfstab file
checkout the manpage for share_nfs(1M)
example: share -F nfs -o root=hostname,anon=0 /dir

Put anon=0 after the root=hostname
anon=0 means "export with root access to all hosts the fs is exported
to"
If "root=hostname" doesn't work, then you've used the wrong hostname
and would possibly need to use the FQDN instead. (You can now remove
the root=hostname option
Sponsored Links
    #3  
Old 09-24-2008
gwhelan gwhelan is offline
Registered User
 
Join Date: Jun 2008
Last Activity: 8 March 2009, 9:12 AM EDT
Posts: 40
Thanks: 0
Thanked 0 Times in 0 Posts
Hi Incredible,

Unfortunately the export is coming from a NetApp filer. So I can't edit any of those files you suggested.

I have other NFS shares with the same attributes shared out to other servers with no permission issues.

I have tried mounting an NFS share from the NetApp filer that has no permission issue on another server, on to this solaris 10 server and it mounts with the nobody:nobody permissions. So it must be a setting somewhere on the client thats causing this? Any help is greatly appreciated. Thanks.
    #4  
Old 09-24-2008
incredible incredible is offline Forum Advisor  
Registered User
 
Join Date: May 2008
Last Activity: 1 June 2012, 4:25 AM EDT
Location: SINGAPORE.. The "FINE" City
Posts: 2,693
Thanks: 1
Thanked 19 Times in 19 Posts
cat /etc/default/nfs (show ouput)
The only thing today that prevents the scenario is to use Kerberos V5 (or some other strong authentication system, but Kerberos V5 is what most vendors have) authentication in the NFS traffic itself. This means exporting the volume with option sec=krb5 (or krb5i, or krb5p), and without anon=0 and without root=.

What happens is that even if the attacker su'es to someuser, unless he knows someuser's Kerberos password, he cannot become user someuser over the NFS connection. Even attempting to access /home/someuser as super-user, even with Kerberos credentials for super-user, is defeated, because super-user, uid 0, will be mapped to user nobody (since anon=0 and root= are absent in the export options).
Sponsored Links
    #5  
Old 09-24-2008
incredible incredible is offline Forum Advisor  
Registered User
 
Join Date: May 2008
Last Activity: 1 June 2012, 4:25 AM EDT
Location: SINGAPORE.. The "FINE" City
Posts: 2,693
Thanks: 1
Thanked 19 Times in 19 Posts
And are you using NFS v4 ?
Sponsored Links
    #6  
Old 09-25-2008
gwhelan gwhelan is offline
Registered User
 
Join Date: Jun 2008
Last Activity: 8 March 2009, 9:12 AM EDT
Posts: 40
Thanks: 0
Thanked 0 Times in 0 Posts
I am using NFS version 4. Here is the /etc/default/nfs file.

# cat /etc/default/nfs
# ident "@(#)nfs 1.10 04/09/01 SMI"
#
# Copyright 2004 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#

# Sets the maximum number of concurrent connection oriented connections.
# Default is unlimited and is obtained by not setting NFSD_MAX_CONNECTIONS.
# Equivalent to -c.
#NFSD_MAX_CONNECTIONS=

# Set connection queue length for the NFS over a connection-oriented
# transport. The default value is 32 entries.
# Equivalent to -l.
NFSD_LISTEN_BACKLOG=32

# Start NFS daemon over the specified protocol only.
# Equivalent to -p, ALL is equivalent to -a on the nfsd command line.
# Mutually exclusive with NFSD_DEVICE.
NFSD_PROTOCOL=ALL

# Start NFS daemon for the transport specified by the given device only.
# Equivalent to -t.
# Mutually exclusive with setting NFSD_PROTOCOL.
#NFSD_DEVICE=

# Maximum number of concurrent NFS requests.
# Equivalent to last numeric argument on nfsd command line.
NFSD_SERVERS=16

# Set connection queue length for lockd over a connection-oriented transport.
# Default and minimum value is 32.
LOCKD_LISTEN_BACKLOG=32

# Maximum number of concurrent lockd requests.
# Default is 20.
LOCKD_SERVERS=20

# Retransmit Timeout before lockd tries again.
# Default is 5.
LOCKD_RETRANSMIT_TIMEOUT=5

# Grace period in seconds that all clients (both NLM & NFSv4) have to
# reclaim locks after a server reboot. Also controls the NFSv4 lease
# interval.
# Overrides the deprecated setting LOCKD_GRACE_PERIOD.
# Default is 90 seconds.
GRACE_PERIOD=90

# Deprecated.
# As for GRACE_PERIOD, above.
# Default is 90 seconds.
#LOCKD_GRACE_PERIOD=90

# Sets the minimum version of the NFS protocol that will be registered
# and offered by the server. The default is 2.
#NFS_SERVER_VERSMIN=2

# Sets the maximum version of the NFS protocol that will be registered
# and offered by the server. The default is 4.
#NFS_SERVER_VERSMAX=4

# Sets the minimum version of the NFS protocol that will be used by
# the NFS client. Can be overridden by the "vers=" NFS mount option.
# The default is 2.
#NFS_CLIENT_VERSMIN=2

# Sets the maximum version of the NFS protocol that will be used by
# the NFS client. Can be overridden by the "vers=" NFS mount option.
# If "vers=" is not specified for an NFS mount, this is the version
# that will be attempted first. The default is 4.
#NFS_CLIENT_VERSMAX=4

# Determines if the NFS version 4 delegation feature will be enabled
# for the server. If it is enabled, the server will attempt to
# provide delegations to the NFS version 4 client. The default is on.
#NFS_SERVER_DELEGATION=on

# Specifies to nfsmapid daemon that it is to override its default
# behavior of using the DNS domain, and that it is to use 'domain' as
# the domain to append to outbound attribute strings, and that it is to
# use 'domain' to compare against inbound attribute strings.
#NFSMAPID_DOMAIN=domain
#
Sponsored Links
    #7  
Old 09-25-2008
incredible incredible is offline Forum Advisor  
Registered User
 
Join Date: May 2008
Last Activity: 1 June 2012, 4:25 AM EDT
Location: SINGAPORE.. The "FINE" City
Posts: 2,693
Thanks: 1
Thanked 19 Times in 19 Posts
Change this entry similar to the one shown below:
NFSMAPID_DOMAIN=netapp-sush
Sponsored Links
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Issue with changing the permissions on an nfs mount Tuxidow Shell Programming and Scripting 2 08-01-2011 02:45 AM
NFS Mount permissions weird jamie_collins Solaris 1 03-04-2010 11:40 AM
Change permissions on a mount point livos23 UNIX for Dummies Questions & Answers 0 04-16-2009 07:54 PM
Permissions on NFS mount wstclair Solaris 4 02-01-2009 09:08 AM
After changing permissions, volume wont mount meelismalgand UNIX for Dummies Questions & Answers 0 08-30-2007 04:21 AM



All times are GMT -4. The time now is 11:49 AM.