Solaris

Hi

I can't write to fs "/share/nfs" shared by nfs server despite properly setting RW permissions.
NFS server is configured on CentOS and Solaris10 is client.

CentOS NFS Server config :
--------------------------------
Entries in /etc/exports file :

Code:

[root@centos11 ~]# cat /etc/exports
/inst           *(ro,sync)
/share/nfs      *(rw,sync)

What shares nfs server :

Code:

[root@centos11 ~]# showmount -e localhost
Export list for localhost:
/inst      *
/share/nfs *

What sees nfs client :

Code:

# hostname
solaris10
#
# showmount -e 192.168.56.127
export list for 192.168.56.127:
/inst      *
/share/nfs *
#

SOLARIS10 NFS client config
----------------------------
How Solaris10 client machine mounted nfs share :

Code:

# mount
<output omitted>
/mnt/nfs on 192.168.56.127:/share/nfs remote/read/write/setuid/devices/soft/vers=3/xattr/dev=4bc0002 on So cz 25 17:48:20 2011

I have no idea why I can't write changes to /share/nfs fs from Solaris10 client machine.
When I try to do this I get the following output :

Code:

# touch /mnt/nfs/file2.txt
touch: cannot create /mnt/nfs/file2.txt: Permission denied

Please advise me how to repair this.

thx for help

Which version of CentOS are you using?

On the Centos NFS server, what is the output of

Code:

exportfs -v

Code:

[root@centos11 ~]# exportfs -v
/share/nfs      <world>(rw,wdelay,root_squash,no_subtree_check,anonuid=65534,anongid=65534)
/inst           <world>(ro,wdelay,root_squash,no_subtree_check,anonuid=65534,anongid=65534)

I had similar issue not so long ago. Try adding "insecure" option to /share/nfs export properties.

@bartus11 I added 'insecure' deirective to /etc/exports file, restarted deamon but nothing changed.

---------- Post updated at 06:59 PM ---------- Previous update was at 06:23 PM ----------

I found the answer.
There was problem with "root_squash" option in /etc/exports file which is default option when not specified.

When this option is used, then while mounting using the command mount, the user ID ?root? on the NFS client will be replaced by the user ID ?nobody? on the NFS server. This is to prevent the root on the NFS client from taking a superuser privilege on the NFS server, thus perhaps illegally allowing him to modify files on the NFS server.

So I solve this :
------------------
1. mount -o remount,acl /share
2. setfacl -m user:nfsnobody:rwx /share/nfs


It mounts with UID=65534 and GUID=65534 which on CentOS=nfsnobody and on Solaris10=nobody4(UID) and nogroup(GID).

[root@centos11 share]# exportfs -v
/share/nfs <world>(rw,wdelay,insecure,root_squash,no_subtree_check,anonuid=65534,anongid=65534)
/inst <world>(ro,wdelay,root_squash,no_subtree_check,anonuid=65534,anongid=65534)

To display UID/GID on centos/sol10 use

Code:

$ ls -ln

You can of course change UID that mounts nfs share from default 65534 to whatever you like but it must exist on both systems : centos nad sol10 with the same UID/GID

Security :
----------
The best would be to run nfs inside ssh tunnel.
Here you have how to do it --->
NFS Security - The Community's Center for Security

what is the "root_squash" that you have a problem in , I think root not allowed to be used over network.

I don't have problem with ''root_squash'' anymore. Read my answer above.