Restricting NFS to interfaces/IPsīy default, starting rvice will listen for connections on all network interfaces, regardless of /etc/exports. Without this, ZFS shares will no longer be exported after a reboot. Note: If exporting ZFS shares, also start/ enable rvice.

To view the current loaded exports state in more detail, use:įor more information about all available options see exports(5). It should be noted that modifying /etc/exports while the server is running will require a re-export for changes to take effect: Use an asterisk ( *) to allow access from any interface.In practice neither omitting nor including the insecure option provides any meaningful improvement or detriment to security.) (Presumably only the root user can use low-numbered ports, so blocking other ports by default creates a superficial barrier to access. The insecure option allows clients to connect from ports above 1023.Being different from crossmnt, nohide still respects address ranges of child exports. Instead of crossmnt, one can also use the nohide option on child exports so that they can be automatically mounted when a client mounts the root export.Note this may not be desirable if a child is shared with a different range of addresses. The crossmnt option makes it possible for clients to access all filesystems mounted on a filesystem marked with crossmnt and clients will not be required to mount every child export separately.The export is /srv/nfs/music via a bind mount to the actual target /mnt/music.Bind mounts are used to link the share mount point to the actual directory elsewhere on the filesystem. A good security practice is to define a NFS root in a discrete directory tree which will keep users limited to that mount point. These shares are relative to the so-called NFS root. The NFS server needs a list of directories to share, in the form of exports (see exports(5) for details) which one must define in /etc/exports or /etc/exports.d/*.exports.

Users of simple configurations should not need to edit this file. Global configuration options are set in /etc/nfs.conf.

Without accurate clocks on all nodes, NFS can introduce unwanted delays. It is highly recommended to use a time synchronization daemon to keep client/server clocks in sync. Enable NFSv4 idmapping or overrule the UID/GID manually by using anonuid/ anongid together with all_squash in /etc/exports.īoth client and server only require the installation of the nfs-utils package.

NFS expects the user and/or user group IDs are the same on both the client and server.

Unlike Samba, NFS does not have any user authentication by default, client access is restricted by their IP-address/ hostname.

Configure #TLS encryption or tunnel NFS through an encrypted protocol like Kerberos or (secure) VPN when dealing with sensitive data.

Instal AutoMounter free